A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…
Red Hat · StreamsHub Console for Apache Kafka®
A flaw in Red Hat's StreamsHub Console for Apache Kafka lets a Kubernetes tenant who holds create permission on Console custom resources set the API container image to an arbitrary image, which the operator then deploys under a ServiceAccount bound to broad cluster-wide Strimzi permissions. An attacker needs only low-privileged, tenant-level access over the network with no user interaction, and once their code runs in that pod it can read the projected ServiceAccount token to gain cross-tenant read and write access to the Strimzi control plane.
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 20 Oct 2026. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.