Live › vulnerability › CVE-2026-105949
Go to dashboardCruise Control registers its Jetty security constraints on exact paths only, so a request with extra leading path segments skips authentication yet still reaches admin endpoints like rebalance. An unauthenticated attacker can trigger cluster rebalancing and other admin actions over the network.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| cruise-control | maven | >= 2.0.82, < 3.1.0 | 3.1.0 |
2.0.82 up to but not including 3.1.0 is affectedkubectl get networkpolicy to confirm :9090 is limited to operator pods3.1.0 (Maven coordinates are now io.cruise-control; it continues from 2.5.146 and upgrades Jetty to 12.0.39)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.
This page as .md · .json · in your agent: get_signal("CVE-2026-105949")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.