A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 6
https://access.redhat.com/security/cve/CVE-2026-96740
secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2539427
secalert@redhat.com
https://github.com/streamshub/console/pull/2957
secalert@redhat.com
https://github.com/advisories/GHSA-3rpr-3qjq-fg52
secalert@redhat.com
https://github.com/streamshub/console/commit/d45897e12
secalert@redhat.com
https://github.com/streamshub/console/commit/ef13971
secalert@redhat.com