Cruise Control CVE-2026-105949

Exploitation requires network reachability to the Cruise Control REST API (default port 9090) from an adjacent network position (AV:A) - not internet-wide access. The flaw is present because Jetty's ConstraintSecurityHandler registers constraints only on exact path specs with no catch-all wildcard and without setDenyUncoveredHttpMethods(true), and the servlet normalizes the request path using Path.of(pathInfo).getFileName(), which strips leading segments and trailing slashes. The primary LIMITING factor is deployment: in Red Hat AMQ Streams, the Strimzi operator's NetworkPolicy restricts port 9090 to operator pods only, so a default Strimzi deployment is not reachable by ordinary workloads - exploitation realistically requires Cruise Control to be exposed outside that NetworkPolicy, the NetworkPolicy to be disabled/misconfigured, or attacker presence within the operator network path. No user interaction or authentication is required once the port is reachable.

This is a genuine authentication bypass (CWE-287) in Cruise Control's Jetty security handling, where exact-path security constraints combined with servlet path normalization via Path.of(pathInfo).getFileName() allow all 15 admin endpoints to be reached without authentication. The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.8) signals an easily exploitable, unauthenticated, high-impact flaw - but note AV:A (Adjacent), NOT AV:N (Network), which materially constrains reach: the attacker must already be on the same network segment/broadcast domain as the Cruise Control port (9090), not arbitrarily remote across the internet. The most important mitigating signal comes from the description itself: in Red Hat AMQ Streams, the Strimzi operator's NetworkPolicy restricts port 9090 to operator pods only, which Red Hat uses to downgrade effective severity to 'Important' rather than Critical. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input; absent those, there is no evidence of active exploitation or published exploit code. Net assessment: a real, high-impact logic flaw worth patching, but real-world risk in a default Strimzi/AMQ Streams deployment is bounded by the NetworkPolicy and the Adjacent attack vector, so prioritize it for clusters where Cruise Control is exposed beyond operator pods or where the NetworkPolicy is not enforced.

An attacker with access to the network segment where Cruise Control listens (port 9090) sends a crafted request such as POST /kafkacruisecontrol/x/rebalance; because the servlet strips leading path segments to just the filename, the request evades the exact-path security constraint yet still dispatches to the privileged admin handler. With no authentication required (PR:N), the attacker can then invoke any of the 15 admin endpoints to trigger cluster rebalancing or other disruptive operations. No public exploit identified at time of analysis, so this scenario is derived from the described mechanism rather than observed in-the-wild activity.