CVE-2026-92778
CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 16, 2026
- Updated
- Sep 17, 2026
- Reserved
- Sep 16, 2026
Description
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-693 Protection Mechanism Failure
Affected Products
| Product | Versions |
|---|---|
CMAKyahoo |
|
References
- GitHub Issue #936issue-tracking
- https://github.com/yahoo/CMAKproduct
- the HTML form action has no featureGate while the API action at 141 doestechnical-description
- VulnCheck Advisory: CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.