{"id":"CVE-2026-105311","title":"Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy","summary":"The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with …","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-441"],"vendor":"Red Hat","product":"console","affected":["console >= 0.2.0 < 0.12.10","console >= 0.13.0 < 0.14.2","console-operator (all versions)","console-operator (all versions)"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T11:30:09.568Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105311","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-105311"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510875","label":"RHBZ#2510875"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T12:05:07.317Z","slug":"CVE-2026-105311","body":"## Overview\n\nThe StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.\n\n## Affected\n\n- `console >= 0.2.0 < 0.12.10`\n- `console >= 0.13.0 < 0.14.2`\n- `console-operator (all versions)`\n- `console-operator (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\n1. Restrict Console CR RBAC — remove create/update verbs on consoles.console.streamshub.github.com from tenant-facing roles. Only trusted cluster administrators should manage Console CRs.\n2. Audit existing Console CRs — review all Console CRs for kafkaUser.namespace fields pointing outside the CR's own namespace.\n3. Network policy (defense-in-depth) — apply NetworkPolicy to restrict operator pod egress.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}