{"id":"CVE-2026-105311","summary":"Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy","details":"The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.","modified":"2026-10-22T10:30:17.232295714Z","published":"2026-10-20T11:30:09.568Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105311.json","cna_assigner":"redhat","cwe_ids":["CWE-441"]},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-105311"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510875"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105311.json"},{"type":"PACKAGE","url":"https://github.com/streamshub/console"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105311"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/streamshub/console","events":[{"introduced":"e4fe8ddaffb3f45e0061439a31d31b3d4c0dcb70"},{"fixed":"641e2028362fda24741d07ccba00174fb4e1255b"},{"introduced":"48f23a0a636d2ab18f1a175d1e2d0c2d8aef1a91"},{"fixed":"528fabf03111db594b2f8602f0c4887a72ea2ca0"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0.2.0"},{"fixed":"0.12.10"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0.13.0"},{"fixed":"0.14.2"}]}]}}],"versions":["0.14.1","0.12.9","0.12.8","0.14.0","0.12.7","0.13.0","0.12.6","0.12.5","0.12.4","0.12.3","0.12.2","0.12.1","0.12.0","0.11.0","0.10.3","0.10.2","0.10.1","0.10.0","0.9.0","0.8.2","0.8.1","0.8.0","0.7.0","0.6.3","0.6.2","0.6.1","0.6.0","0.5.0","0.4.0","0.3.4","0.3.3","0.3.2","0.3.1","0.3.0","0.2.1","0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105311.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}]}