CRITICALCVSS v3.1 9.9Vulnerability
CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
Properties
- First seen
- 2026-10-20T22:33:57+00:00
- Cvss score
- 9.9
- Last seen
- 2026-10-20T22:33:57+00:00
- Euvd assigner
- redhat
- Retrieved at
- 2026-10-21T00:34:21+00:00
- Src batch id
- euvd-20261021T003401Z-4c0cc1
- Source url
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104964
- Score
- 9.9
- Euvd base score version
- 3.1
- Fetched at
- 2026-10-21T00:34:20+00:00
- Euvd vendor
- Red Hat
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- First seen by Signal
- 2026-10-20T13:03:27+00:00
- Euvd base score
- 9.9
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- Content hash
- 96c94df13698f44c992d646cd32c9536e387931b8d32d11448e52fa65e0b67f8
- Published at
- 2026-10-20T12:17:28.703
- Euvd updated
- 2026-10-20T22:33:57+00:00
- Last modified
- 2026-10-20T17:17:27.860
- Euvd epss pct
- 0
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph