CVE-2026-96740

Description

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.

Traduire en français

Produits concernés

• Red Hat StreamsHub Console for Apache Kafka®
• Red Hat streams for Apache Kafka 2
• Red Hat streams for Apache Kafka 3

Scores CVSS

Faiblesses (CWE)

• CWE-470

Références

• https://access.redhat.com/security/cve/CVE-2026-96740
• https://bugzilla.redhat.com/show_bug.cgi?id=2539427
• https://github.com/advisories/GHSA-3rpr-3qjq-fg52
• https://github.com/streamshub/console/commit/d45897e12
• https://github.com/streamshub/console/commit/ef13971
• https://github.com/streamshub/console/pull/2957

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories