Log in Start free

Vulnerability · Published Sep 28, 2026 · Assigned by redhat

CVE-2026-96740Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

Medium 6.5

In plain English

A medium-severity security flaw in streams for Apache Kafka 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 64.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.

Affected products (as reported)

VendorProductVersions
Red Hat StreamsHub Console for Apache Kafka® 0.2.1 – before 0.12.90.13.0 – before 0.14.1
Red Hat streams for Apache Kafka 2 see references
Red Hat streams for Apache Kafka 3 see references

Weakness: CWE-470 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References