CVE-2026-105312: Red Hat Kafka Console Bug Exposes Control Plane to Untrusted Tenants

Published October 20, 2026, CVE-2026-105312 is a privilege escalation vulnerability in Red Hat StreamsHub Console for Apache Kafka with a CVSS 9.9 score. A Kubernetes tenant with only permission to create a Console custom resource can inject an arbitrary container image that the operator executes with cluster-wide privileges on the Strimzi control plane. The bug does not affect Kubernetes or Apache Kafka themselves; it resides in the management console operator. For operators of multi-tenant clusters, the risk is concrete: isolation between namespaces is compromised.

How the Attack Works: From Custom Resource to Control Plane

The mechanics are linear. According to shattered.io, "a tenant who can create one custom resource can take over Kafka control-plane objects across every namespace on the cluster." The malicious input passes through the spec.containers.api.spec.image field of a Console custom resource: a tenant with create or update permission writes a reference to an arbitrary container image there. The operator, without additional validation, deploys it in a new pod.

The pod runs with a ServiceAccount whose binding is cluster-scoped. Strix.ai documents the effective permissions: get, list, watch on all Strimzi CRDs (Kafka, KafkaConnect, KafkaMirrorMaker2, KafkaTopic, KafkaUser, and others), patch on Kafkas and KafkaRebalances, plus cluster-monitoring-view. The attacker reads the projected ServiceAccount token and gains cross-tenant access to the Strimzi control plane. This is not a leak of external credentials; it is the operator itself materializing the privilege escalation.

The CWE-269 classification (Improper Privilege Management) aligns with the pattern: the vulnerable component (Console operator) accepts input from a low-privilege principal and executes it with a high-privilege identity, without mediation. It is the classic confused deputy, but with cluster-wide consequences on critical infrastructure.

Why CVSS 9.9 with Scope Changed Is Not a Detail

The full CVSS 3.1 vector — confirmed by shattered.io, strix.ai, and Rapid7 — is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. The base score of 9.9 is exceptional for a bug requiring authentication (PR:L): the attacker must have an account in the cluster, even if unprivileged. The acceleration to the top of the scale comes from S:C, Scope Changed.

Shattered.io explains the metric clearly: "the Scope Changed flag deserves the most attention. It tells scoring teams that the vulnerable component and the impacted component sit in different security authorities." In the Kubernetes context, this means the tenant namespace (one security authority) and the cluster-wide Strimzi control plane (another security authority) are boundaries the bug crosses without authorization. This is not a buffer overflow corrupting local memory; it is an architectural failure of security boundaries in a multi-tenant system.

The combination AV:N/AC:L/UI:N indicates the attack is reproducible over the network, with low complexity, and no user interaction. Once create permission on Console resources is obtained — which in a multi-tenant cluster can be granted to development teams, CI/CD service accounts, or namespace admins — the rest is deterministic. Low availability impact (A:L) slightly mitigates the score, but confidentiality and integrity impact are maximal.

Who Is Exposed and Who Is Not

The risk perimeter is circumscribed but critical for those inside it. Exposed are multi-tenant deployments where untrusted tenants — or accounts with limited privileges — hold create, update, or patch rights on Console resources. According to shattered.io, "deployment single-tenant or with only admin managing Console resources NOT exposed to this specific path." This excludes clusters where the operator is managed exclusively by the platform team with root-equivalent access.

The affected product is Red Hat StreamsHub Console for Apache Kafka, also known as Streams for Apache Kafka Console. The bug is not in the Strimzi core operator or Apache Kafka; it is in the management console operator providing the management UI/API. Versions fixing the defect are 0.12.10 and 0.14.2 for upstream StreamsHub Console, and Streams for Apache Kafka 3.2.2 for the downstream Red Hat product. CVE Brief indicates a fix documented October 22, but primary sources do not independently verify this date.

What to Do Now

Update to versions 0.12.10, 0.14.2, or Streams for Apache Kafka 3.2.2 per shattered.io.

Verify in multi-tenant clusters who holds create, update, patch permissions on Console custom resources: restrict these rights to only accounts with documented operational need.

Review the ClusterRoleBinding of the ServiceAccount used by the Console operator: the cluster-wide privilege over Strimzi CRDs is functionally required by design, but its exposure to pods whose image is controllable by tenants must be treated as a critical attack surface.

Assess whether the current deployment is genuinely multi-tenant: if single-tenant with admin-centralized management, the attack path does not apply, but permission review remains a hygiene practice.

"The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view" — strix.ai advisory summary

The Operator Pattern: A Design Problem, Not Just Code

The technical reading goes beyond the single bug. CVE-2026-105312 is a case study in the recurring pattern of Kubernetes operators with excessive privileges executing user input. The principle of least privilege is violated at the architectural level: the operator needs cluster-wide access to function, but the pod materializing that access should not be influenceable by tenants with lower privileges.

For platform teams and security architects, the question is whether the threat assessment model for operator custom resources is adequate. The spec.containers.api.spec.image field is technically a configuration input, but functionally a code execution vector with privileged identity. The separation between who can create a CR and who can choose the image running in the resulting pod is often absent in operator designs. Red Hat has fixed the bug, but the pattern persists in all Kubernetes operators with CRs mutable by multiple tenants.

The estimated EPSS of 0.3% from CVE Brief indicates low probability of mass exploitation in the near term: the requirement for authenticated access to a Kubernetes cluster and product specificity reduce the surface for opportunistic attacks. This does not diminish the impact for targeted objectives: in a multi-tenant cluster with sensitive Kafka data, the bug is a direct bridge from the isolated namespace to the critical control plane.

Frequently Asked Questions

Are read permissions enough to exploit the bug?

No. According to technical sources, create or equivalent (update, patch) permission on Console custom resources is required. Read-only access does not trigger the attack path.

Does the bug affect all Strimzi installations?

No. It specifically affects those using Red Hat StreamsHub Console for Apache Kafka in multi-tenant deployments. Users of the Strimzi core operator without Console, or with Console in single-tenant admin-managed mode, are not exposed to this vector.

Why is CVSS so high with authentication required?

The Scope Changed flag (S:C) is the critical multiplier. The impact does not stay in the tenant namespace: it crosses cluster security boundaries and hits other tenants' resources. With confidentiality and integrity at maximum, the score reaches 9.9 despite PR:L.

Sources

• shattered.io
• strix.ai
• rapid7.com