Key points
- CVE-2026-105949 affects Red Hat Streams for Apache Kafka versions 2 and 3.
- The vulnerability carries a CVSS score of 8.8, rated as high severity.
- Network policies in AMQ Streams may limit the effective risk.
Red Hat Streams for Apache Kafka versions 2 and 3 are affected by CVE-2026-105949. This flaw allows attackers to bypass authentication on administrative endpoints. The issue stems from how Cruise Control handles security constraints and path routing. No patch has been confirmed yet, so teams must assess their exposure carefully.
In plain English
The problem lies in how Cruise Control registers security rules. It applies constraints to specific paths but lacks a wildcard catch-all. It also fails to deny uncovered HTTP methods. This configuration gap means certain requests can slip through authentication checks.
The background
Cruise Control uses a method that strips leading path segments and trailing slashes from requests. An attacker can craft a URL, such as POST /kafkacruisecontrol/x/rebalance, to exploit this. The system processes the filename part of the path, ignoring the prefix. This allows the request to reach admin endpoints without proving identity.
What changes now
All fifteen admin endpoints become reachable without authentication if this flaw is exploited. According to the National Vulnerability Database, this is a CWE-287 authentication bypass. The CVSS score is 8.8, which is classified as high. Organizations using Red Hat Streams for Apache Kafka 2 or 3 must treat this as urgent.
Who needs to act first
Teams should prioritize systems exposed to untrusted networks. Check whether network policies restrict access to port 9090. If the Strimzi operator enforces these rules, the risk is lower. Verify that only operator pods can reach the service. Isolate affected clusters from public internet access immediately. Monitor logs for unusual request patterns targeting admin paths.
What to do and how to stay safe: Red Hat
- Review network policies to ensure port 9090 is not publicly accessible.
- Check if the Strimzi operator is enforcing access restrictions on Cruise Control.
- Monitor server logs for requests with unusual path structures or methods.
- Wait for vendor updates before applying any unverified workarounds.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which products are affected by CVE-2026-105949?
Red Hat Streams for Apache Kafka versions 2 and 3 are affected.
What is the severity of this vulnerability?
The CVSS score is 8.8, which is rated as high severity.
Can network policies reduce the risk?
Yes, AMQ Streams NetworkPolicy restricts port 9090 to operator pods, reducing effective severity.
