CVE-2026-105312

Awaiting Analysis Awaiting Analysis - Queue

Kubernetes Console CR Arbitrary Image Deployment Privilege Escalation

Publication date: 2026-10-20

Last updated on: 2026-11-03

Assigner: redhat-SADP

Description

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-03

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-105312

EUVD

EUVD-2026-104964

Affected Vendors & Products

Vendor	Product	Version / Range
Red Hat	StreamsHub Console for Apache Kafka®	0.2.0
Red Hat	StreamsHub Console for Apache Kafka®	0.13.0
Red Hat	streams for Apache Kafka 2	*
Red Hat	streams for Apache Kafka 3	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability allows a Kubernetes tenant with create permissions on Console custom resources to set a container image to an arbitrary one. The operator then deploys this image into a pod with a ServiceAccount that has cluster-wide access to Strimzi CRDs. The attacker can read the ServiceAccount token and gain cross-tenant control-plane access, escalating privileges from namespace to cluster level.

Detection Guidance

Check Kubernetes clusters for unauthorized Console custom resources with modified container images. Inspect pods running with the console-server ServiceAccount for unexpected image specifications. Review ClusterRoleBindings associated with Strimzi CRDs for excessive permissions.

Impact Analysis

An attacker could gain unauthorized access to sensitive data, manipulate Kafka clusters, and perform actions like reading or modifying KafkaUsers, Kafkas, and KafkaRebalances. This could lead to data breaches, service disruptions, or unauthorized control over the Kafka infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance. It may result in data breaches, unauthorized data access, or integrity violations, requiring organizations to report incidents and implement additional safeguards.

Mitigation Strategies

Remove create/update/patch permissions for non-administrators on Console CRs. Deploy an admission webhook to validate container images against a trusted registry. Apply network policies to restrict pod egress. Deploy the Console operator in a single-tenant environment with only trusted administrators managing Console CRs.

Hi! I’m here to help you understand CVE-2026-105312. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...