Medium severity · published Sep 28, 2026
CVE-2026-96740
Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
StreamsHub Console for Apache Kafka® · Red Hat
0.2.1 before 0.12.9; 0.13.0 before 0.14.1 · source: vendor
SF
streams for Apache Kafka 2 · Red Hat
All versions, or not specified · source: vendor
SF
streams for Apache Kafka 3 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-96740
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-96740
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-96740
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2539427
github.com
https://github.com/advisories/GHSA-3rpr-3qjq-fg52
github.com
https://github.com/streamshub/console/commit/d45897e12
github.com
https://github.com/streamshub/console/commit/ef13971
github.com
https://github.com/streamshub/console/pull/2957
More from streams for Apache Kafka 2
9.9
CVE-2026-105312
Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
9.1
CVE-2026-42264
Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
9.1
CVE-2026-2332
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
8.8
CVE-2026-105949
Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
8.8
CVE-2025-67030
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642