CVE-2026-105949

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949 Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949 Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949 Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949

Cruise Control for Apache Kafka is vulnerable to an authentication bypass due to a misconfiguration in the Jetty ConstraintSecurityHandler . The handler registers security constraints on exact path specifications but fails to use a catch-all wildcard constraint or call setDenyUncoveredHttpMethods...

EUVD-2026-104965

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

PT-2026-118352

Name of the Vulnerable Software and Affected Versions Cruise Control affected versions not specified Description The Jetty ConstraintSecurityHandler registers security constraints on exact path specifications without a catch-all wildcard constraint and fails to call setDenyUncoveredHttpMethodstru...

Red Hat Cruise Control for Apache Kafka authorization issue vulnerability

Red Hat Cruise Control for Apache Kafka contains an authorization issue vulnerability. This vulnerability arises because Jetty’s ConstraintSecurityHandler registers security constraints only on exact path specifications and fails to set wildcard constraints; it also does not call...

CVE-2026-106450 vulnerabilities

Vulnerabilities for packages: apache-polaris, knative-kafka-broker-fips, druid, automq-fips, metabase, automq, cassandra, flink-kubernetes-operator-fips, seata, strimzi-kafka-operator, wildfly, kayenta-fips, akhq, confluent-kafka-jre-bcfips, pinot-fips, conductor, debezium-connector-db2, hono,...

GHSA-343H-94H5-C4WR vulnerabilities

Vulnerabilities for packages: apache-polaris, knative-kafka-broker-fips, druid, automq-fips, metabase, automq, cassandra, flink-kubernetes-operator-fips, seata, strimzi-kafka-operator, wildfly, kayenta-fips, akhq, confluent-kafka-jre-bcfips, pinot-fips, conductor, debezium-connector-db2, hono,...

GHSA-GM45-99XC-R7WV vulnerabilities

Vulnerabilities for packages: apache-polaris, knative-kafka-broker-fips, druid, automq-fips, metabase, automq, cassandra, flink-kubernetes-operator-fips, seata, strimzi-kafka-operator, wildfly, kayenta-fips, akhq, confluent-kafka-jre-bcfips, pinot-fips, conductor, debezium-connector-db2, hono,...

Kafka Cruise Control UI Detection

Kafka Cruise Control UI is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Kafka Cruise Control UI is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kafka Cruise Control UI Detection', 'description':...

Extending Adaptive Cruise Control with Machine Learning Intrusion Detection Systems

An Adaptive Cruise Control ACC system automatically adjusts the host vehicle's speed to maintain a safe following distance from a lead vehicle. In typical implementations, a feedback controller e.g., a Proportional-Integral-Derivative PID controller computes the host vehicle's acceleration using ...