Yahoo CMAK CVE-2026-92778

Requires an authenticated CMAK account (PR:L) with network access to the web UI; the attacker then reaches the PreferredReplicaElection HTML form endpoints that start/stop the recurring election scheduler. The specific defect is that the 'scheduled leader election' feature toggle is enforced only on gated paths and is NOT applied to the underlying HTML form routes, so the feature gate can be bypassed even when the toggle is meant to disable it. Exploitation is limited to environments running CMAK ≤3.0.0.6 that manage live Kafka clusters; impact is confined to operational disruption of leader elections (no confidentiality exposure). The authentication requirement and lack of a public exploit meaningfully limit realistic risk despite the network attack vector.

This is a low-to-moderate-severity issue best characterized as a protection-mechanism failure (CWE-693), not a critical flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) scores 5.3 and is internally consistent with the description: a network-reachable but authenticated (PR:L) attacker bypasses a feature toggle to reach HTML form routes that start/stop the recurring leader-election scheduler. Impact is limited to integrity-low and availability-low (VC:N - no confidentiality loss), reflecting operational disruption of Kafka leadership rather than data theft or code execution. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation - this reads as a niche operational-integrity bug rather than an urgent priority. The main real-world risk is an authenticated low-privilege CMAK user (or a hijacked session/CSRF-style form submission) toggling leader elections to churn cluster leadership. No signals conflict; the chief limiter is the PR:L authentication requirement, which keeps this out of mass-exploitation territory.

An attacker with a low-privileged CMAK account (or who can induce an authenticated operator's browser to submit a form) navigates directly to the PreferredReplicaElection HTML form endpoints, which fail to honor the scheduled-leader-election feature toggle. By repeatedly starting and stopping the recurring election scheduler, the attacker forces leadership reassignments across managed Kafka clusters, degrading availability and stability. No public exploit code is identified at time of analysis, but the attack requires only crafted HTTP requests to known form routes and is technically trivial (AC:L).