{"id":"CVE-2026-105312","published":"2026-10-20T12:17:28Z","modified":"2026-10-20T17:17:27Z","title":"A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…","vendor":"Red Hat","product":"StreamsHub Console for Apache Kafka®","tier":"core","eol":null,"description":{"text":"A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in Red Hat's StreamsHub Console for Apache Kafka lets a Kubernetes tenant who holds create permission on Console custom resources set the API container image to an arbitrary image, which the operator then deploys under a ServiceAccount bound to broad cluster-wide Strimzi permissions. An attacker needs only low-privileged, tenant-level access over the network with no user interaction, and once their code runs in that pod it can read the projected ServiceAccount token to gain cross-tenant read and write access to the Strimzi control plane.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:20:16Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.00336,"percentile":0.27042,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-105312","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510863","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-104964","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104964","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105312","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":12.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":5.41,"detail":"percentile 0.2704"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}