CVE-2026-105311

The StreamsHub Console operator is vulnerable to a confused deputy attack due to a lack of same-namespace checks. A Kubernetes tenant with permission to create a Console custom resource can specify an arbitrary namespace in spec.kafkaClusters[].credentials.kafkaUser.namespace. Because the operato...

CVE-2026-105311 Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...