Key points
- The flaw affects Red Hat StreamsHub Console versions before 0.12.10 and 0.14.2.
- Attackers with create permissions can deploy arbitrary images to gain elevated access.
- The vulnerability is rated critical with a CVSS score of 9.9.
Red Hat StreamsHub Console for Apache Kafka is affected by a critical security vulnerability in versions prior to 0.12.10 and 0.14.2. This flaw allows a Kubernetes tenant with create permissions on Console custom resources to set the container image to an arbitrary value. According to the National Vulnerability Database record, the operator then deploys this image into a pod. That pod’s ServiceAccount is bound to a ClusterRole granting broad cluster-wide permissions.
In plain English
The issue stems from how the console handles container images specified by users. A tenant with basic create permissions can inject a custom container image that the system trusts. Once deployed, this container runs with privileges tied to a high-level service account. That account has read and write access to critical Strimzi resources across the entire cluster, including Kafka users and configurations.
The background
The vulnerability is tracked as CVE-2026-105312 and carries a CVSS score of 9.9, which is classified as critical. It involves weakness CWE-269, related to improper privilege management. The affected products include Red Hat StreamsHub Console for Apache Kafka, Red Hat Streams for Apache Kafka 2, and Red Hat Streams for Apache Kafka 3. The flaw exists in versions released before the specific cutoff dates mentioned in the advisory.
What changes now
Organizations using these Red Hat products must verify their current console versions immediately. If you are running a version before 0.12.10 or 0.14.2, you are exposed to this risk. The National Vulnerability Database record confirms the severity but does not explicitly state if a patch has been released for all affected lines. Users should check vendor channels for the latest version status and update procedures to mitigate the risk of unauthorized cluster access.
Who needs to act first
Teams should prioritize updating systems that are exposed to external networks or untrusted internal tenants. Check whether your current deployment allows users to create custom resources with container specifications. Begin by backing up existing configurations before applying any changes. Test updates in a non-production environment to ensure stability. If immediate updates are not possible, restrict create permissions on console custom resources to trusted administrators only. Monitor logs for unusual container deployments or unexpected service account usage.
What to do and how to stay safe: Red Hat
- Verify your current version of Red Hat StreamsHub Console against the affected list.
- Restrict create permissions on Console custom resources to trusted administrators only.
- Monitor Kubernetes logs for unexpected container image deployments or privilege escalations.
- Check vendor announcements for confirmed patches or workarounds for the affected versions.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Red Hat products are affected by this vulnerability?
Red Hat StreamsHub Console for Apache Kafka versions before 0.12.10 and 0.14.2, as well as Red Hat Streams for Apache Kafka 2 and 3, are affected.
What is the severity of CVE-2026-105312?
The vulnerability is rated critical with a CVSS score of 9.9, indicating a severe risk to cluster security.
How does an attacker exploit this flaw?
An attacker with create permissions can set a custom container image, which runs with elevated privileges to gain cross-tenant control-plane access.
