CVE-2026-118952Medium 6.5Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules0.2%
CVE-2026-105941High 8.1Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname0.2%
CVE-2026-105949High 8.8Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints0.3%
CVE-2026-105312Critical 9.9Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation0.3%
CVE-2026-105311High 7.7Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy0.3%
CVE-2026-96740Medium 6.5Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers0.4%