CVE-2026-96740

Published: Sep 28, 2026Modified: Oct 5, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.

Related CWEs

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

References (6)

https://access.redhat.com/security/cve/CVE-2026-96740

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2539427

Source: secalert@redhat.com

https://github.com/advisories/GHSA-3rpr-3qjq-fg52

Source: secalert@redhat.com

https://github.com/streamshub/console/commit/d45897e12

Source: secalert@redhat.com

https://github.com/streamshub/console/commit/ef13971

Source: secalert@redhat.com

https://github.com/streamshub/console/pull/2957

Source: secalert@redhat.com

Timeline

No history available yet.