{"id":"CVE-2026-105312","kind":"vulnerability","aliases":["CVE-2026-105312"],"related":[],"title":"Strimzi Console: tenant image injection grants cluster-wide Kafka control-plane access","description":"A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.","summary":"The StreamsHub Console operator (streamshub/console, which manages Strimzi Kafka) lets a tenant with create rights on Console custom resources set spec.containers.api.spec.image to any image. The operator runs it in a pod whose ServiceAccount has a ClusterRoleBinding. The tenant's code reads the token and gets read access to all Strimzi CRDs and patch rights on Kafkas and KafkaRebalances across tenants. This affects Strimzi only through the Console add-on. CVSS 9.9 (Red Hat). Fixed by an operator image allow-list.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"streamshub/console","fixed":["0.12.10","0.14.2"],"affected":">= 0.2.0, < 0.12.10; >= 0.13.0, < 0.14.2","ecosystem":"github"}],"ecosystems":[],"tags":["infrastructure","kafka","kubernetes","multi-tenant-clusters","privilege-escalation","streamshub-console","strimzi"],"not_affected_if":["console-operator-not-installed","image-allowlist-enforced","no-console-custom-resources","no-tenant-console-cr-rbac","single-tenant","single-tenant-cluster"],"how_to_check":"Run: kubectl get crd consoles.console.streamshub.github.com. If it exists, check the operator image version (kubectl get deploy -A -o wide, look for the streamshub console-operator image). Versions 0.2.0 to 0.12.9 and 0.13.0 to 0.14.1 are affected. Then check which Roles or ClusterRoles grant create, update or patch on consoles.console.streamshub.github.com to tenants (kubectl get clusterrole,role -A -o yaml). If only cluster admins can do that, exposure is low.","fix":"Upgrade the Console operator to 0.12.10 (0.12.x line) or 0.14.2 (0.13/0.14 line). These add an operator-level container image allow-list. Configure the allow-list after upgrading. Until then: remove create, update and patch on consoles.console.streamshub.github.com from tenant roles, enforce an image registry allowlist with Kyverno or Gatekeeper on the Console CR, and restrict console-api pod egress with NetworkPolicy. Red Hat Streams for Apache Kafka builds: no fixed version stated on the Red Hat page.","status":"open","published_at":"2026-10-20T12:17:28+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:35+00:00","updated_at":"2026-10-23T23:21:26+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Strimzi Console: tenant image injection grants cluster-wide Kafka control-plane access","impact":"high","summary":"A Kubernetes tenant who can create Strimzi Console custom resources can point the image field at any container image, and the operator runs it in a pod with a powerful cluster-wide ServiceAccount. The attacker's code reads that ServiceAccount token and gets read and write access to Strimzi resources across all tenants.","category":"infrastructure","who_cares":["kubernetes","strimzi","multi-tenant-clusters"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker code runs in operator pod and takes cross-tenant Strimzi control-plane access.","analyst_note":"Sources give no affected or fixed Strimzi versions and no mitigation; check the NVD entry and the Strimzi security advisory for version ranges and the fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["single-tenant-cluster","no-console-custom-resources","image-allowlist-enforced"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000513,"input_tokens":3028,"output_tokens":421,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give no affected or fixed Strimzi versions and no mitigation; check the NVD entry and the Strimzi security advisory for version ranges and the fix.","search":"'-105312':17A,20A '-2026':16A,19A '9.9':107B 'access':14A,82B,192C 'across':94B 'add':104B 'add-on':103B 'affect':97B 'allow':116B 'allow-list':115B 'arbitrari':133C 'attack':173C 'bound':147C 'cluster':8A,28B,155C,169C 'cluster-monitoring-view':168C 'cluster-wid':7A,154C 'clusterrol':152C 'clusterrolebind':71B,149C 'code':75B,175C 'consol':2A,34B,38B,52B,102B,125C 'contain':134C 'control':12A,188C 'control-plan':11A,187C 'crds':86B,161C 'creat':49B,122C 'cross':184C 'cross-ten':183C 'custom':53B,126C 'cve':15A,18A 'cvss':106B 'deploy':138C 'escal':31B 'fix':110B 'gain':182C 'get':80B 'get/list/watch':157C 'grant':6A,153C 'hat':109B 'imag':4A,59B,114B,135C,140C 'includ':162C 'infrastructur':22B 'inject':5A 'kafka':10A,23B,44B,91B 'kafkarebal':93B 'kafkas/kafkarebalances':166C 'kafkaus':163C 'kubernet':24B,119C 'let':45B 'list':117B 'manag':42B 'monitor':170C 'multi':26B 'multi-tenant-clust':25B 'oper':39B,61B,113B,137C 'patch':88B,164C 'permiss':123C 'plane':13A,189C 'pod':66B,143C 'privileg':30B 'privilege-escal':29B 'project':178C 'read':76B,81B,176C,190C 'red':108B 'resourc':54B,127C 'right':50B,89B 'run':62B 'sa':179C 'serviceaccount':68B,145C 'set':55B,129C 'spec.containers.api.spec.image':56B,130C 'streamshub':33B,37B 'streamshub-consol':32B 'streamshub/console':21A,40B 'strimzi':1A,35B,43B,85B,98B,160C,186C 'tenant':3A,27B,47B,73B,95B,120C,185C 'token':78B,180C 'via':148C 'view':171C 'whose':67B,144C 'wide':9A,156C 'write':191C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T12:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105312","severity":null,"published_at":"2026-10-20T12:17:28+00:00","modified_at":"2026-10-20T17:17:27+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105312:424","url":null,"severity":null,"published_at":"2026-10-23T23:21:26+00:00","modified_at":"2026-10-23T23:21:26+00:00","first_seen_at":"2026-10-23T23:21:26+00:00","fetched_at":"2026-10-23T23:21:26+00:00","note":"Affected product is StreamsHub Console (streamshub/console operator, also Red Hat Streams for Apache Kafka Console), not Strimzi itself. Ranges from the CVE.org record; fix in 0.12.10 / 0.14.2 (release notes #3039 image allow-list). Red Hat page lists workarounds. No PoC or exploitation seen; X posts are noise. Sibling CVE-2026-105311 fixed in same release."}],"documents":[{"id":1909,"url":"https://access.redhat.com/security/cve/cve-2026-105312","title":"Red Hat CVE-2026-105312","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1910,"url":"https://github.com/streamshub/console/releases/tag/0.14.2","title":"streamshub/console 0.14.2 (adds image allow-list, #3039)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1911,"url":"https://www.cve.org/CVERecord?id=CVE-2026-105312","title":"CVE Record CVE-2026-105312 (affected ranges)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}