EUVD-2026-81041
GHSA-8c8p-h27x-rrc9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable form routes exploitable by any authenticated low-priv user (PR:L, AC:L); no data exposure (C:N), only integrity/availability disruption of leader elections (I:L/A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.
AnalysisAI
Yahoo CMAK through 3.0.0.6 fails to enforce its scheduled leader election feature toggle on the PreferredReplicaElection HTML form routes, allowing an authenticated user (CVSS PR:L) with network access to the web UI to start or stop the recurring election scheduler and disrupt leadership across the Kafka clusters managed by that instance. This is a protection-mechanism failure (CWE-693) with no confidentiality impact (C:N) and limited integrity/availability impact (I:L/A:L); the assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), and no public exploit code has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated CMAK account (PR:L) with network access to the web UI; the attacker then reaches the PreferredReplicaElection HTML form endpoints that start/stop the recurring election scheduler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-to-moderate-severity issue best characterized as a protection-mechanism failure (CWE-693), not a critical flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the issue is tracked in the CMAK repository at https://github.com/yahoo/CMAK/issues/936 and the affected routes are in app/controllers/PreferredReplicaElection.scala, so administrators should watch for an upstream fix or apply a local code change that enforces the scheduled leader-election feature toggle on the PreferredReplicaElection HTML form routes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. Rated critical severity (CVSS 9.8), this vu
Request smuggling in the http4s Ember HTTP/1.1 parser lets an unauthenticated, remote attacker bypass front-end access c
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for
In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections. Ra
Cross-site request forgery in Yahoo CMAK (Cluster Manager for Apache Kafka) through 3.0.0.6 allows an attacker to make a
Same weakness CWE-693 – Protection Mechanism Failure
View allShare
External POC / Exploit Code
Leaving vuln.today