Streams for Apache Kafka Cruise Control: Authentication bypass via path segment
Summary
Cruise Control, the Kafka cluster management component shipped in Red Hat Streams for Apache Kafka 2 and 3, can be tricked into skipping its authentication checks by adding an extra path segment to a request. The servlet then routes the request to its administrative endpoints, so an unauthenticated caller can run sensitive cluster operations such as rebalancing. The attacker needs network access to Cruise Control port 9090, and Red Hat rates the impact as Important because the Strimzi operator's NetworkPolicy normally restricts that port to operator pods.
Affected
- Cruise Control for Apache Kafka 2.0.82 to before 3.1.0 (upstream)
- Red Hat Streams for Apache Kafka 2 (default: affected)
- Red Hat Streams for Apache Kafka 3 (default: affected)
Fixed in
- Cruise Control for Apache Kafka 3.1.0 (upstream)
- Red Hat fixed package builds for Streams for Apache Kafka 2 and 3: Unknown.
Workaround
- Verify that a Strimzi NetworkPolicy exists and that it restricts Cruise Control port 9090 to operator pods, and confirm that the cluster's CNI enforces it.
- Do not expose Cruise Control port 9090 via Ingress or Route.
- Confirm that TLS is enabled on the Cruise Control HTTP endpoint (Strimzi default).
- For standalone Cruise Control: deploy a path-normalizing reverse proxy and restrict port 9090 via firewall.
- Forward administrative endpoint calls to a SIEM to detect unauthorized actions.
- These measures reduce exposure but do not fix the defect.
Exploitation
- Not known to be exploited in the wild.
- Not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No verified public proof of concept.
Our recommendation
- Check whether Cruise Control or Strimzi is deployed.
- Confirm that port 9090 is reachable only by operator pods through an enforced NetworkPolicy.
- Apply the vendor fix once the Red Hat package build is confirmed, or upgrade upstream Cruise Control to 3.1.0 or later.
- Monitor calls to administrative endpoints until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-105949 access.redhat.com
- Red Hat Bugzilla 2510878 bugzilla.redhat.com
- Upstream fix commit github.com
- Red Hat Hydra security data access.redhat.com
- Vulners CVE entry vulners.com
- OpenCVE entry app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:35.
Original description (NVD)
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.