CVE-2026-105949
Received Received - Intake

Cruise Control Jetty Path Security Bypass

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: redhat-SADP

Description
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-105949
EUVD
EUVD-2026-104965

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Red Hat streams for Apache Kafka 2 *
Red Hat streams for Apache Kafka 3 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105949 is an authentication bypass vulnerability in Cruise Control's Jetty ConstraintSecurityHandler. Security constraints are registered on exact path specs without a catch-all wildcard or setDenyUncoveredHttpMethods(true). The servlet uses Path.of(pathInfo).getFileName() which strips leading segments and trailing slashes, allowing requests like POST /kafkacruisecontrol/x/rebalance to bypass authentication while reaching admin endpoints. All 15 admin endpoints become accessible without authentication.

Detection Guidance

Check if Cruise Control admin endpoints are accessible without authentication by sending requests like POST /kafkacruisecontrol/x/rebalance to the server. Verify if responses indicate successful access to admin functions. Inspect network traffic for unauthorized requests to port 9090.

Impact Analysis

This vulnerability allows unauthorized users to bypass authentication and access sensitive admin functions. Attackers could exploit it to perform unauthorized actions, expose sensitive data, or execute arbitrary code. The impact includes confidentiality, integrity, and availability breaches with a CVSS score of 8.8 (High).

  • Unauthenticated access to all admin endpoints.
  • Potential data exposure or arbitrary code execution.
  • Reduced impact in AMQ Streams with Strimzi operator due to NetworkPolicy restrictions.
Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance risks include fines, legal penalties, and reputational damage due to potential data breaches and lack of proper access controls.

Mitigation Strategies

For AMQ Streams with Strimzi, ensure the NetworkPolicy restricts port 9090 to operator pods only. Disable Ingress/Route exposure for port 9090 and enable TLS on the Cruise Control HTTP endpoint. For standalone Cruise Control, deploy a path-normalizing reverse proxy and restrict port 9090 via firewall.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105949. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart