CVE-2026-105312
Received Received - Intake

Kubernetes Console CR Arbitrary Image Deployment Privilege Escalation

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: redhat-SADP

Description
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-105312
EUVD
EUVD-2026-104964

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Red Hat StreamsHub Console for Apache Kafka® 0.2.0
Red Hat StreamsHub Console for Apache Kafka® 0.13.0
Red Hat streams for Apache Kafka 2 *
Red Hat streams for Apache Kafka 3 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a Kubernetes tenant with create permissions on Console custom resources to set a container image to an arbitrary one. The operator then deploys this image into a pod with a ServiceAccount that has cluster-wide access to Strimzi CRDs. The attacker can read the ServiceAccount token and gain cross-tenant control-plane access, escalating privileges from namespace to cluster level.

Detection Guidance

Check Kubernetes clusters for unauthorized Console custom resources with modified container images. Inspect pods running with the console-server ServiceAccount for unexpected image specifications. Review ClusterRoleBindings associated with Strimzi CRDs for excessive permissions.

Impact Analysis

An attacker could gain unauthorized access to sensitive data, manipulate Kafka clusters, and perform actions like reading or modifying KafkaUsers, Kafkas, and KafkaRebalances. This could lead to data breaches, service disruptions, or unauthorized control over the Kafka infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance. It may result in data breaches, unauthorized data access, or integrity violations, requiring organizations to report incidents and implement additional safeguards.

Mitigation Strategies

Remove create/update/patch permissions for non-administrators on Console CRs. Deploy an admission webhook to validate container images against a trusted registry. Apply network policies to restrict pod egress. Deploy the Console operator in a single-tenant environment with only trusted administrators managing Console CRs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105312. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart