CVE-2026-105311
High
Description
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.
SeverityHigh
CVSS7.7
Exploit probability—
Product
StreamsHub Console for Apache Kafka®
PublishedOct 20, 2026
First seenOct 20, 2026
Weakness typeCWE-441CWE-441
How to fix
Update
- Red Hat StreamsHub Console for Apache Kafka®0.12.10, 0.14.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat StreamsHub Console for Apache Kafka® | 0.2.0 ≤ v < 0.12.10, 0.13.0 ≤ v < 0.14.2 | 0.12.10, 0.14.2 |
| Red Hat streams for Apache Kafka 3 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.