CVE-2026-96740CWE-470

CVE-2026-96740

Medium · published September 28, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00407 · 33.9th percentile
Weakness
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Published
2026-09-28T22:17Z
References (6)
https://access.redhat.com/security/cve/CVE-2026-96740 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2539427 · [email protected]https://github.com/advisories/GHSA-3rpr-3qjq-fg52 · [email protected]https://github.com/streamshub/console/commit/d45897e12 · [email protected]https://github.com/streamshub/console/commit/ef13971 · [email protected]https://github.com/streamshub/console/pull/2957 · [email protected]
EPSS history
Timeline
  • 30 SEP 03:29Z
    EPSS moved — → 0%
    epss
  • 28 SEP 17:27Z
    Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers
    cvelistv5