VulnSea

cruise_control_for_apache_kafka vulnerabilities

CVEs whose affected-version data names the cruise_control_for_apache_kafka package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-105949High· 8.8
today

Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(…

▾ TwilightRed Hat · Cruise Control for Apache Kafkavia CVEORG
cruise_control_for_apache_kafka vulnerabilities (CVEs) · VulnSea