CVE-2026-105312 Red Hat CVE debrief

Who should care

Kubernetes administrators, Apache Kafka operators, and security teams responsible for monitoring and securing containerized environments should assess exposure and verify proper configuration of ClusterRoles, ServiceAccounts, and container image deployments.

Why it matters

CVE-2026-105312 allows a Kubernetes tenant to escalate privileges from namespace to cluster level in StreamsHub Console for Apache Kafka. Defenders should verify proper configuration of ClusterRoles, ServiceAccounts, and container image deployments to prevent potential unauthorized access and disruption of Kafka services.

• Potential privilege escalation from namespace to cluster level
• Increased risk of unauthorized access to Strimzi resources
• Possible disruption of Kafka services and data integrity
• Need for verification of ClusterRoleBindings and ServiceAccount permissions

Technical summary

The Console-operator in StreamsHub Console for Apache Kafka allows a Kubernetes tenant with create permission on Console custom resources to set spec.containers.api.spec.image to an arbitrary container image. This image is deployed into a pod with a ServiceAccount bound to a ClusterRole granting cluster-wide permissions on Strimzi CRDs, including KafkaUsers, Kafkas, and KafkaRebalances. An attacker can read the projected ServiceAccount token and gain cross-tenant Strimzi control-plane read and write access.

Defensive priority

High

Recommended defensive actions

• Review and restrict create permissions on Console custom resources
• Monitor and limit container image deployments
• Verify and enforce proper ClusterRoleBindings and ServiceAccount permissions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected products. The vulnerability is caused by the Console-operator in StreamsHub Console for Apache Kafka allowing a Kubernetes tenant with create permission on Console custom resources to set spec.containers.api.spec.image to an arbitrary container image. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access. Evidence is limited to the provided CVE record and may

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.