Advisoriesby IbisRed HatCVE-2026-105311
The StreamsHub Console operator acts as a confused deputy
Fix: upgrade to 0.12.10 or later (2 fixed versions below)
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| StreamsHub Console for Apache Kafka® Product | >= 0.2.0, < 0.12.10 | 0.12.10 |
| >= 0.13.0, < 0.14.2 | 0.14.2 | |
| streams for Apache Kafka 2 Product | all versions | No fix yet |
| streams for Apache Kafka 3 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-441