{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Red Hat StreamsHub Console for Apache Kafka®: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/red-hat--streamshub-console-for-apache-kafka/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/red-hat--streamshub-console-for-apache-kafka/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105312/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105312/",
   "title": "CVE-2026-105312 · Red Hat StreamsHub Console for Apache Kafka® · disclosed",
   "content_text": "A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.",
   "date_published": "2026-10-20T11:30:20Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105311/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105311/",
   "title": "CVE-2026-105311 · Red Hat StreamsHub Console for Apache Kafka® · disclosed",
   "content_text": "The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.",
   "date_published": "2026-10-20T11:30:09Z"
  }
 ]
}