Advisories · Technology
Red Hat streams for Apache Kafka 2.
Every CVE that names Red Hat streams for Apache Kafka 2 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules
- Red Hat streams for Apache Kafka 2
- Red Hat streams for Apache Kafka 3
- Broken access control
- CVSS 8.8 High
Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
- Red Hat streams for Apache Kafka 2
- Red Hat streams for Apache Kafka 3
- Authentication bypass
- CVSS 9.9 CriticalCritical · CVSS 9+
Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
- Red Hat StreamsHub Console for Apache Kafka®
- Red Hat streams for Apache Kafka 2
- Privilege escalation
- CVSS 7.7 High
Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
- Red Hat StreamsHub Console for Apache Kafka®
- Red Hat streams for Apache Kafka 2
- CWE-441
- CVSS 6.5 Medium
Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers
- Red Hat StreamsHub Console for Apache Kafka®
- Red Hat streams for Apache Kafka 2
- Code injection