Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

Overview

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

Affected

• console >= 0.2.0 < 0.12.10
• console >= 0.13.0 < 0.14.2
• console-operator (all versions)
• console-operator (all versions)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Workarounds

1. Restrict Console CR RBAC — remove create/update verbs on consoles.console.streamshub.github.com from tenant-facing roles. Only trusted cluster administrators should manage Console CRs.
2. Audit existing Console CRs — review all Console CRs for kafkaUser.namespace fields pointing outside the CR's own namespace.
3. Network policy (defense-in-depth) — apply NetworkPolicy to restrict operator pod egress.