redhat/console-operator vulnerabilities

Latest redhat/console-operator CVEs

Newest publication first

1. CVE-2026-105312 Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

   Published 2026-10-20

   Critical·CVSS 9.9 EPSS 0.34%

   A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide ge...

2. CVE-2026-105311 Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

   Published 2026-10-20

   High·CVSS 7.7 EPSS 0.30%

   The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim...

3. CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

   Published 2026-09-28

   Medium·CVSS 6.5 EPSS 0.41%

   A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.pr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.