Key points
- CVE-2026-105312 affects Red Hat StreamsHub Console versions before 0.12.10 and 0.14.2.
- The flaw allows privilege escalation to cluster-wide read and write access via container image manipulation.
- No patch has been confirmed yet; teams must assess exposure and plan for vendor updates.
Red Hat StreamsHub Console for Apache Kafka contains a critical security flaw that permits unauthorized cluster-wide access. The vulnerability, tracked as CVE-2026-105312, affects versions prior to 0.12.10 and 0.14.2, impacting Red Hat streams for Apache Kafka 2 and 3 environments.
What happened
A Kubernetes tenant possessing only create permissions on Console custom resources can exploit this flaw. According to the NVD record, an attacker can set the spec.containers.api.spec.image field to an arbitrary container image. The Strimzi operator then deploys this malicious image into a pod. This pod runs with a ServiceAccount that is bound via ClusterRoleBinding to a ClusterRole.
That ClusterRole grants cluster-wide get, list, and watch permissions on all Strimzi Custom Resource Definitions. This includes sensitive resources such as KafkaUsers. The role also allows patch operations on Kafkas and KafkaRebalances, plus cluster-monitoring-view access. The attacker’s code reads the projected ServiceAccount token from within the pod.
This action grants the attacker cross-tenant Strimzi control-plane read and write access. The weakness is classified under CWE-269, which relates to improper privilege management. The CVSS score is 9.9, rated as critical severity. The flaw exists in Red Hat StreamsHub Console for Apache Kafka before version 0.12.10 and before version 0.14.2.
Why it matters
Organisations using Red Hat StreamsHub Console face significant risk if they have not updated their software. The ability to escalate from simple create permissions to cluster-wide control is severe. Attackers can manipulate Kafka configurations and user credentials across the entire cluster. This compromises the integrity of the entire Strimzi control plane.
The exposure is particularly dangerous in multi-tenant environments. A single compromised tenant can pivot to affect all other tenants. The flaw leverages the trust placed in the operator to deploy images. This bypasses standard isolation mechanisms between tenants. Security teams must treat this as a high-priority incident.
What happens next
- Identify all instances of Red Hat StreamsHub Console running versions before 0.12.10 or 0.14.2.
- Monitor logs for unusual container image deployments or unexpected ServiceAccount token usage.
- Restrict create permissions on Console custom resources to trusted administrators only.
- Prepare for the release of updated versions by testing in isolated environments first.
- Review ClusterRoleBindings to ensure least privilege principles are applied to all operators.
Patch priority
Teams usually prioritise systems exposed to untrusted users or external networks. Check whether your console instances are accessible to tenants with create permissions. Validate that no arbitrary images can be specified in custom resources. Back up current configurations before making any changes. Test updates in a non-production environment to ensure stability. Reduce exposure by limiting network access to the console API. Monitor for any signs of privilege escalation attempts. Coordinate with vendor communications for official guidance. Ensure backup and restore procedures are functional. Review access controls to minimise the blast radius of any potential compromise.
What to do and how to stay safe: Red Hat
- Audit all Kubernetes namespaces for users with create permissions on Console custom resources.
- Implement network policies to restrict access to the Strimzi operator and console components.
- Enable detailed audit logging for all container image deployments and ServiceAccount token usage.
- Verify that your current console versions are not among those affected by CVE-2026-105312.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Red Hat StreamsHub Console are affected by CVE-2026-105312?
Versions before 0.12.10 and before 0.14.2 are affected.
What is the CVSS score for this vulnerability?
The CVSS score is 9.9, which is rated as critical.
Is there a patch available for CVE-2026-105312?
No patch has been confirmed yet; teams should await vendor updates.
