CVE-2026-105311 Red Hat CVE debrief

Who should care

Kubernetes administrators, Apache Kafka operators, and security teams responsible for clusters with multiple tenants or sensitive data should be aware of this vulnerability and take immediate action to assess exposure and apply mitigations. These stakeholders must verify their inventory of affected StreamsHub Console for Apache Kafka versions and monitor for suspicious activity.

Why it matters

A confused deputy vulnerability in the StreamsHub Console operator for Apache Kafka allows cross-namespace KafkaUser Secret exfiltration, posing a high risk to clusters with multiple tenants or sensitive data.

• Secret exfiltration across namespaces
• Potential data breaches or unauthorized access
• Need for immediate patching or mitigation
• Verification of inventory and exposure required

Technical summary

The StreamsHub Console operator for Apache Kafka acts as a confused deputy, allowing a Kubernetes tenant to exfiltrate KafkaUser Secrets from other namespaces by setting spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. This vulnerability arises from the operator's use of cluster-wide Secrets RBAC, which enables it to read Secrets from any namespace. As a result, an attacker with permission to create a Console custom resource can access sensitive KafkaUser Secrets, potentially leading to unauthorized data access or breaches.

Defensive priority

High-priority assessment and remediation recommended for clusters with multiple tenants or sensitive data.

Recommended defensive actions

• Assess exposure in clusters with multiple tenants or sensitive data
• Verify inventory of affected StreamsHub Console for Apache Kafka versions
• Apply vendor-provided patches or mitigations
• Monitor for suspicious Secret access or modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The StreamsHub Console operator acts as a confused deputy, reading victim-namespace KafkaUser Secrets and writing plaintext material to a Secret in the attacker's namespace. This behavior allows for the exfiltration of KafkaUser Secrets across namespaces, posing a significant risk to clusters with multiple tenants or sensitive data. The vulnerability is grounded in the operator's cluster-wide Secrets RBAC, which enables it to access and write Secrets across namespaces.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.