CVE-2026-96740

Katalog CVE

CVSS 6.5 · Medium EPSS 0,41%

Kerentanan Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'). Skor CVSS 3.1 6.5 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.

Rincian

Terbit di NVD

28 September 2026

Terakhir diubah

5 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

6.5 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-96740
• https://bugzilla.redhat.com/show_bug.cgi?id=2539427
• https://github.com/advisories/GHSA-3rpr-3qjq-fg52
• https://github.com/streamshub/console/commit/d45897e12
• https://github.com/streamshub/console/commit/ef13971
• https://github.com/streamshub/console/pull/2957