Live › vulnerability › CVE-2026-105312
Go to dashboardThe StreamsHub Console operator (streamshub/console, which manages Strimzi Kafka) lets a tenant with create rights on Console custom resources set spec.containers.api.spec.image to any image. The operator runs it in a pod whose ServiceAccount has a ClusterRoleBinding. The tenant's code reads the token and gets read access to all Strimzi CRDs and patch rights on Kafkas and KafkaRebalances across tenants. This affects Strimzi only through the Console add-on. CVSS 9.9 (Red Hat). Fixed by an operator image allow-list.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| streamshub/console | github | >= 0.2.0, < 0.12.10; >= 0.13.0, < 0.14.2 | 0.12.10, 0.14.2 |
kubectl get crd consoles.console.streamshub.github.com0.2.0 to 0.12.9 and 0.13.0 to 0.14.1 are affected0.12.10 (0.12.x line) or 0.14.2 (0.13/0.14 line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
This page as .md · .json · in your agent: get_signal("CVE-2026-105312")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.