---
id: "CVE-2026-105949"
kind: "vulnerability"
aliases: ["CVE-2026-105949"]
title: "Cruise Control: path tricks bypass Jetty auth on all 15 admin endpoints"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "cruise-control", "fixed": ["3.1.0"], "affected": ">= 2.0.82, < 3.1.0", "ecosystem": "maven"}]
ecosystems: []
tags: ["amq-streams", "cruise-control", "kafka", "kubernetes", "package", "self-hosted", "strimzi"]
not_affected_if: ["auth-disabled-and-network-isolated", "auth-required", "network-restricted-to-operator", "port-9090-not-reachable"]
published_at: "2026-10-20T12:17:28+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-24T00:15:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105949", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:15:08+00:00"}]
---

# Cruise Control: path tricks bypass Jetty auth on all 15 admin endpoints

Cruise Control registers its Jetty security constraints on exact paths only, so a request with extra leading path segments skips authentication yet still reaches admin endpoints like rebalance. An unauthenticated attacker can trigger cluster rebalancing and other admin actions over the network.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:cruise-control affected >= 2.0.82, < 3.1.0 fixed 3.1.0

## How to check

Find your version: Cruise Control 2.0.82 up to but not including 3.1.0 is affected. On Strimzi/AMQ Streams, check the Cruise Control image and run kubectl get networkpolicy to confirm :9090 is limited to operator pods. With auth enabled, an unauthenticated POST to /kafkacruisecontrol/x/rebalance that is not answered 401/403 means you are exposed. Test only on your own cluster, since a successful request starts a rebalance.

## Fix

Upgrade to Cruise Control 3.1.0 (Maven coordinates are now io.cruise-control; it continues from 2.5.146 and upgrades Jetty to 12.0.39). Until then: keep :9090 off Ingress/Route, restrict it to operator pods or by firewall, and put a path-normalizing reverse proxy in front of standalone installs. For AMQ Streams, wait for a Red Hat fixed build; none is listed.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105949
- 2026-10-24T00:15:08+00:00 analyst — CVE record: affected 2.0.82 to <3.1.0, fixed 3.1.0 (release notes 'Fix endpoint routing', commit 0680880 in ParameterUtils; release notes don't cite the CVE, and the commit was not diffed for the Jetty constraint change). Red Hat page: the NetworkPolicy limits Strimzi/AMQ Streams exposure only if port 9090 is not exposed; Red Hat rates it Important there. No Red Hat fixed build listed yet. No PoC or exploitation seen (not in KEV). Did not search social posts.

## Documents

- [advisory] Red Hat CVE-2026-105949 https://access.redhat.com/security/cve/cve-2026-105949
- [advisory] CVE record CVE-2026-105949 https://www.cve.org/CVERecord?id=CVE-2026-105949
- [fix] Fix endpoint routing (#2411) https://github.com/cruise-control-for-kafka/cruise-control/commit/0680880be8483e87a39832de807b68d5e9918325
- [fix] Cruise Control 3.1.0 release notes https://newreleases.io/project/github/cruise-control-for-kafka/cruise-control/release/3.1.0

## From the sources

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_