Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

Overview

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

Affected

• console >= 0.2.0 < 0.12.10
• console >= 0.13.0 < 0.14.2
• console-operator (all versions)
• console-operator (all versions)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Workarounds

1. Restrict Console CR RBAC — remove create/update/patch verbs on consoles.console.streamshub.github.com from tenant-level Roles. Only cluster administrators should manage Console CRs.
2. Deploy admission webhook — use OPA/Gatekeeper or Kyverno policy to validate spec.containers.api.spec.image against a trusted registry allowlist.
3. Apply network policies — restrict console-api pod egress to only required endpoints.
4. Single-tenant deployment — deploy the Console operator where only trusted administrators manage Console CRs.