Yahoo CMAK CVE-2026-92751

Exploitation requires an authenticated CMAK operator (through 3.0.0.6) with an active session to be tricked into loading attacker-controlled web content (UI:P) while their HTTP Basic credentials or play-basic-authentication cookie are valid. The enabling condition is the confirmed absence of any CSRF filter/token and the lack of SameSite protection on the authentication cookie, so cross-site forged POSTs to state-changing endpoints (topic deletion, cluster configuration) succeed. Limiting factors: the attacker cannot read responses (no confidentiality impact), the operator must be authenticated and must interact with the malicious page, and any deployment fronting CMAK with SameSite=Strict/Lax cookies or an external anti-CSRF layer would blunt the attack.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H) describes a classic CSRF: network-reachable, low complexity, no attacker authentication (PR:N) because the attack rides the victim operator's own HTTP Basic credentials or play-basic-authentication cookie, but it requires the operator to be lured into interacting with attacker content (UI:P). Impact is integrity/availability only (VI:H/VA:H - topic deletion, cluster config changes); there is no confidentiality impact (VC:N), consistent with a blind forged request whose response the attacker cannot read. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis' - not confirmed exploitation. The real-world priority is moderate rather than urgent: the flaw is genuine and destructive if triggered, but exploitation is gated on social-engineering an authenticated operator (UI:P) and on the operator's session/credentials being active with cookies lacking SameSite protection. The absence of SameSite and any anti-CSRF token is the confirmed root cause (missing CSRF filter never installed in KafkaManagerLoader.scala). No signals conflict; the main limiter is required operator interaction, which keeps this below the level of an unauthenticated direct RCE despite the network vector.

An attacker hosts a web page containing a hidden auto-submitting form targeting a CMAK state-changing endpoint (e.g., topic deletion or cluster reconfiguration) and lures an authenticated Kafka operator to visit it. The operator's browser automatically attaches their HTTP Basic credentials or play-basic-authentication cookie (no SameSite protection), and CMAK executes the forged request as the operator. No public POC is identified, but the attack is straightforward given the fully documented missing-CSRF-filter root cause.