EUVD-2026-88379
GHSA-3rpr-3qjq-fg52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain RBAC rights to author Console CR
-
DeliveryInject config.providers + bootstrap.servers pointing to attacker broker
-
Exploitconsole-api copies props into AdminClient unfiltered
-
ExecutionAdminClient connects to attacker broker
-
PersistServiceAccount token exfiltrated
-
ImpactReplay token to escalate access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V15 - Secure Coding and Architecture Reflection safety, class allowlisting
|
| Exploitation Conditions | The attacker must have permission (RBAC) to create or modify the StreamsHub Console custom resource in the cluster, matching the CVSS PR:L. Within that CR they must set the Kafka client properties config.providers and bootstrap.servers to attacker-controlled values so that console-api's AdminClient connects to an external broker and leaks its ServiceAccount token. No user interaction is needed (UI:N). Exploitation is limited by the requirement that the attacker already hold write access to Console CRs - an authenticated, semi-trusted role - so a cluster with tight RBAC on Console resources substantially reduces exposure; unauthenticated external actors cannot trigger it. |
| Impact | This is a moderate-severity, privilege-dependent information disclosure. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) tells the real story: exploitation is network-reachable and low-complexity, but requires PR:L - an authenticated actor who can author or edit the Console custom resource in the cluster. Impact is confidentiality-only (C:H, I:N/A:N), consistent with exfiltration of the console-api ServiceAccount token; there is no direct integrity or availability effect from the flaw itself, though a stolen ServiceAccount token can be replayed to escalate. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automated exploitation - this reads as an insider/tenant-abuse or misconfiguration-boundary weakness rather than a mass-exploited internet risk. Signals are internally consistent (no CVSS-vs-description conflict); the main caveat is that PR:L here means 'has permission to write a Console CR', which in a properly RBAC-segmented cluster is already a semi-trusted role, further narrowing realistic exploitation. |
| Exploit ScenarioDerived | A tenant or user with rights to create/edit the StreamsHub Console custom resource sets attacker-controlled Kafka client properties (config.providers and bootstrap.servers) that are copied unfiltered into the console-api AdminClient configuration. When console-api initializes the AdminClient, it connects to the attacker's broker and its ServiceAccount token is leaked to that endpoint. No public exploit code is identified at time of analysis, and no user interaction is required once the malicious CR is applied. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
ServiceAccount token exfiltration in the StreamsHub Console for Apache Kafka lets a user who already holds RBAC permission to create or modify the Console custom resource point the console-api AdminClient at an attacker-controlled broker. Tenant-supplied Kafka client properties are copied into the AdminClient configuration without filtering security-sensitive keys, so setting config.providers and bootstrap.servers causes the console-api ServiceAccount token to be read and leaked off-cluster. The issue is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-470) and is a moderate-severity, privilege-dependent information disclosure: it requires an authenticated, semi-trusted role with write access to Console CRs (PR:L), so clusters with tight RBAC on those resources are substantially less exposed, and unauthenticated external actors cannot trigger it. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV); no EPSS score was provided.
RemediationAI
No vendor-released patch version is identified in the available data, and the only references provided are the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-96740) and the Bugzilla tracker (https://bugzilla.redhat.com/show_bug.cgi?id=2539427); track those for an RHSA and apply the patched Streams for Apache Kafka 2.x/3.x build once published. Until then, the highest-value control is RBAC: restrict who can create or update the StreamsHub Console custom resource (and any resource whose spec feeds console-api client properties) to trusted cluster administrators only, since the attack strictly requires that write permission - trade-off is reduced self-service for tenants. Layer a validating admission policy (Kyverno, OPA Gatekeeper, or ValidatingAdmissionPolicy) that rejects or strips security-sensitive Kafka client keys such as config.providers and its config.providers.*.class parameters, bootstrap.servers, sasl.jaas.config, and ssl.keystore.location from the Console CR, or restricts them to an allowlist of approved values; trade-off is that legitimate provider-based or custom-broker configurations must be pre-approved and can break silently if the policy is too broad. Harden the console-api workload itself: run it under a dedicated ServiceAccount with least-privilege RBAC and set automountServiceAccountToken: false where the token is not needed, so a successful redirect yields a low-value credential. Finally, enforce egress NetworkPolicy or firewall rules so console-api can only reach approved in-cluster broker endpoints, which blunts exfiltration to an attacker-controlled broker but will break any legitimate cross-cluster or external broker connectivity. Audit logs for Console CR modifications and for unexpected outbound AdminClient connections should be enabled to detect exploitation attempts.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the StreamsHub Console operator/console-api component of Red Hat Streams for Apache Kafka. The Console custom resource allows tenants to supply Kafka client properties, and those properties are merged into the AdminClient configuration used by console-api without an allowlist or denylist of security-sensitive keys. Two Kafka client keys are abused in combination: config.providers, which names a ConfigProvider implementation class that the client instantiates by name at runtime, and bootstrap.servers, which selects the broker endpoint. CWE-470 (Use of Externally-Controlled Input to Select Classes or Code, i.e. unsafe reflection) accurately describes the root cause, since the attacker effectively chooses which provider class gets loaded; a file-backed provider can read the pod's mounted ServiceAccount token, while bootstrap.servers redirects the resulting client connection to an attacker-controlled broker, completing the exfiltration. No TLS/SASL interception or memory-corruption primitive is involved, and the confidentiality impact is high precisely because the leaked credential is the console-api ServiceAccount token, which may carry cluster privileges beyond the attacker's original CR-write access. The associated CPEs (cpe:2.3:a:red_hat:streams_for_apache_kafka_2 and cpe:2.3:a:red_hat:streams_for_apache_kafka_3) confirm both the 2.x and 3.x Streams for Apache Kafka product lines are in scope.
Know when Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Requires authenticated ability to write the Console CR (PR:L), network-reachable and low-complexity (AV:N/AC:L); impact is ServiceAccount token disclosure only (C:H, I:N/A:N).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue ar
Exploit-DB