CVE-2026-105312

Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

State: Published
Severity: 9.9 Critical
Published: Oct 20, 2026
Updated: Oct 20, 2026
Reserved: Oct 5, 2026

Read the record on cve.org

Description

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L	redhat

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
StreamsHub Console for Apache Kafka®Red Hat	0.2.0 to before 0.12.10Affected 0.13.0 to before 0.14.2Affected
streams for Apache Kafka 2Red Hat
streams for Apache Kafka 3Red Hat

References

https://access.redhat.com/security/cve/CVE-2026-105312vdb-entry
RHBZ#2510863issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.