CVE-2026-105311

Status: Awaiting AnalysisHigh (7.7)—

Severity7.7High · CVSS 3.1

Exploitation probability—next 30 days

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

CVSS

Base score: 7.7
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitation probability (EPSS)

FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement80 %
Primary impactT1552.007 Container APIcredential access85 %
Secondary impactT1005 Data from Local Systemcollection55 %

Un tenant con permiso para crear recursos Console abusa del operador (confused deputy) y lee Secrets de otro namespace con RBAC amplio, copiando credenciales en texto plano.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account Management Network Segmentation Vulnerability Scanning User Account Management Threat Intelligence Program Limit Access to Resource Over Network

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Streamshub — Console Operator^AI

CWEs

CWE-441

References

Show 2 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-105311",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "StreamsHub Console for Apache Kafka®",
          "versions": [
            {
              "status": "affected",
              "version": "0.2.0",
              "lessThan": "0.12.10",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "0.13.0",
              "lessThan": "0.14.2",
              "versionType": "semver"
            }
          ],
          "packageName": "console",
          "collectionURL": "https://github.com/streamshub/console",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:amq_streams:2"
          ],
          "vendor": "Red Hat",
          "product": "streams for Apache Kafka 2",
          "packageName": "console-operator",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:amq_streams:3"
          ],
          "vendor": "Red Hat",
          "product": "streams for Apache Kafka 3",
          "packageName": "console-operator",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-20T12:17:28.550",
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-105311",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510875",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-441"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path."
    }
  ],
  "lastModified": "2026-10-20T15:03:59.857",
  "sourceIdentifier": "secalert@redhat.com"
}