Medium severity · published Sep 16, 2026
CVE-2026-92778
CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
CMAK · yahoo
through 3.0.0.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92778
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92778
github.com
https://github.com/yahoo/CMAK
github.com
https://github.com/yahoo/CMAK/blob/3.0.0.6/app/controllers/PreferredReplicaElection.scala#L110-L143
github.com
https://github.com/yahoo/CMAK/issues/936
www.vulncheck.com
https://www.vulncheck.com/advisories/cmak-through-3.0.0.6-feature-gate-bypass-via-html-form-routes
More from CMAK
8.1
CVE-2026-92751
CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter