Red Hat streams for Apache Kafka 2

• CVE-2026-118952 Medium 6.5 Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules 0.2%
• CVE-2026-105949 High 8.8 Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints 0.3%
• CVE-2026-105312 Critical 9.9 Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation 0.3%
• CVE-2026-105311 High 7.7 Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy 0.3%
• CVE-2026-96740 Medium 6.5 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers 0.4%