StreamsHub Console for Apache Kafka® vulnerabilities

2 known vulnerabilities in StreamsHub Console for Apache Kafka® from Red Hat. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  StreamsHub Console for Apache Kafka®: Improper Privilege Management

  CVE-2026-105312Oct 20, 2026Red Hat

  A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole gran

• 7.7 High severity

  StreamsHub Console for Apache Kafka®: Unintended Proxy or Intermediary

  CVE-2026-105311Oct 20, 2026Red Hat

  The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RB