Vulnerability · Published Oct 20, 2026 · Assigned by redhat

CVE-2026-105949Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

High 8.8

In plain English

A high-severity improper authentication in Cruise Control for Apache Kafka. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 74.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

Affected products (as reported)

Vendor	Product	Versions
	Cruise Control for Apache Kafka	2.0.82 – before 3.1.0
Red Hat	streams for Apache Kafka 2	see references
Red Hat	streams for Apache Kafka 3	see references

Weakness: CWE-287 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-105949 vdb-entry, x_refsource_REDHAT
RHBZ#2510878 issue-tracking, x_refsource_REDHAT
https://github.com/cruise-control-for-kafka/cruise-control/commit/0680880be8483e87a39832de807b68d5e9918325