Critical Privilege Escalation Flaw Found in Red Hat Strimzi Console Versions
A CVSS 9.9 vulnerability allows Kubernetes tenants to hijack Strimzi control-plane permissions via arbitrary container image deployment.
Key points
- CVE-2026-105312 is rated Critical with a CVSS score of 9.9 by the National Vulnerability Database.
- The flaw affects Red Hat StreamsHub Console for Apache Kafka versions prior to 0.12.10 and 0.14.2.
- Attackers with create permissions on Console custom resources can gain cluster-wide read and write access.
Red Hat has disclosed a critical security vulnerability in its Strimzi console components that allows unauthorized users to escalate privileges within Kubernetes clusters. The flaw, identified as CVE-2026-105312, carries a CVSS score of 9.9, indicating severe risk according to the National Vulnerability Database.
At a glance
- CVE
- CVE-2026-105312
- Product
- Red Hat StreamsHub Console for Apache Kafka®
- CVSS
- 9.9 Critical
- Weakness
- improper privilege management
- Exploited
- No known exploitation
The vulnerability enables a Kubernetes tenant with specific permissions to deploy arbitrary container images. This action triggers the operator to run code within a pod that possesses elevated privileges. The pod’s ServiceAccount is bound to a ClusterRole granting broad access to Strimzi resources across the cluster.
How the Exploit Works
The attack vector requires the attacker to have create permission on Console custom resources. According to the NVD record, the user sets the `spec.containers.api.spec.image` field to an arbitrary image. The operator then deploys this image into a pod.
This pod runs with a ServiceAccount linked via ClusterRoleBinding to a ClusterRole. This role grants cluster-wide get, list, and watch permissions on all Strimzi Custom Resource Definitions, including KafkaUsers. It also allows patch operations on Kafkas and KafkaRebalances, plus cluster-monitoring-view access.
The malicious code inside the deployed container reads the projected ServiceAccount token. This grants the attacker cross-tenant control-plane read and write access to Strimzi components. The weakness is classified under CWE-269, which covers improper privilege management.
Affected Products
The vulnerability impacts specific versions of Red Hat’s Kafka management tools. Red Hat StreamsHub Console for Apache Kafka is affected in versions before 0.12.10. Versions before 0.14.2 of the same product are also vulnerable.
Red Hat Streams for Apache Kafka 2 is listed as an affected product. Red Hat Streams for Apache Kafka 3 is similarly impacted. The source material does not specify exact version ranges for the Streams 2 and 3 products beyond their inclusion in the affected list.
The NVD record lists the affected versions for the console but does not explicitly state that a patch has been released for the broader Streams 2 and 3 platforms. Users should verify their specific installations against the known vulnerable ranges.
What should you do?
Administrators should immediately audit their Kubernetes clusters for unauthorized Console custom resource creations. Review ServiceAccount bindings for Strimzi operators to ensure they follow least-privilege principles. Monitor pod deployments for unexpected container images that do not match known operator signatures.
What to do and how to stay safe: Red Hat
- Audit Kubernetes namespaces for Console custom resource creation events that do not match expected operational patterns.
- Verify that ServiceAccounts used by Strimzi operators are not bound to ClusterRoles with broader permissions than necessary for their function.
- Implement admission controllers to restrict which container images can be deployed by operator-managed pods, blocking arbitrary image pulls.
- Once the vendor provides an update, apply patches to Red Hat StreamsHub Console and Streams for Apache Kafka immediately.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-105312?
The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.9.
Which Red Hat products are affected by this flaw?
Red Hat StreamsHub Console for Apache Kafka before 0.12.10 and 0.14.2, plus Red Hat Streams for Apache Kafka 2 and 3.
How does an attacker exploit this vulnerability?
By setting an arbitrary container image in a Console custom resource, causing the operator to deploy a pod with elevated cluster-wide Strimzi permissions.
