CVE-2026-105949 Red Hat CVE debrief

Who should care

Kafka administrators, security teams, and developers using Cruise Control for Apache Kafka should assess exposure and implement mitigations. This includes reviewing configurations, monitoring for suspicious activity, and applying vendor-provided patches or updates. Urgent attention is required to prevent potential unauthorized access to Kafka clusters and data breaches.

Why it matters

The authentication bypass vulnerability in Cruise Control for Apache Kafka allows unauthenticated access to all admin endpoints, posing a significant risk to Kafka clusters and requiring urgent attention from administrators and security teams.

• Potential unauthorized access to Kafka clusters
• Increased risk of data breaches or tampering
• Need for urgent patching or mitigation
• Potential impact on Kafka cluster availability

Technical summary

The authentication bypass vulnerability in Cruise Control for Apache Kafka allows unauthenticated access to all admin endpoints due to a misconfigured Jetty ConstraintSecurityHandler. This handler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints.

Defensive priority

High priority for Kafka administrators and security teams

Recommended defensive actions

• Review and update Cruise Control for Apache Kafka configurations to restrict access to admin endpoints
• Implement additional security measures to prevent unauthorized access
• Monitor for suspicious activity on Kafka clusters
• Verify and apply vendor-provided patches or updates
• Conduct thorough exposure review for affected Kafka deployments
• Inventory affected assets and track remediation progress
• Consider compensating controls for exposed systems while remediation is pending

Evidence notes

Official CVE Program record and NVD vulnerability detail page provide information on the authentication bypass vulnerability in Cruise Control for Apache Kafka. The CVE record was published on 2026-10-20T11:30:29.296Z and has not been modified since then. The vulnerability affects Apache Kafka Cruise Control, allowing unauthenticated access to admin endpoints. Evidence is based on CVE Program and NVD sources, with limitations on source-provided details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.