{"id":"CVE-2026-105312","summary":"Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation","details":"A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.","modified":"2026-10-21T10:45:47.764280816Z","published":"2026-10-20T11:30:20.850Z","database_specific":{"cwe_ids":["CWE-269"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105312.json","cna_assigner":"redhat"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-105312"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510863"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105312.json"},{"type":"PACKAGE","url":"https://github.com/streamshub/console"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105312"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/streamshub/console","events":[{"introduced":"e4fe8ddaffb3f45e0061439a31d31b3d4c0dcb70"},{"fixed":"641e2028362fda24741d07ccba00174fb4e1255b"},{"introduced":"48f23a0a636d2ab18f1a175d1e2d0c2d8aef1a91"},{"fixed":"528fabf03111db594b2f8602f0c4887a72ea2ca0"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0.2.0"},{"fixed":"0.12.10"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.13.0"},{"fixed":"0.14.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"versions":["0.14.1","0.12.9","0.12.8","0.14.0","0.12.7","0.13.0","0.12.6","0.12.5","0.12.4","0.12.3","0.12.2","0.12.1","0.12.0","0.11.0","0.10.3","0.10.2","0.10.1","0.10.0","0.9.0","0.8.2","0.8.1","0.8.0","0.7.0","0.6.3","0.6.2","0.6.1","0.6.0","0.5.0","0.4.0","0.3.4","0.3.3","0.3.2","0.3.1","0.3.0","0.2.1","0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105312.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L"}]}