Advisories · Technology
Red Hat streams for Apache Kafka 3.
Every CVE that names Red Hat streams for Apache Kafka 3 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules
- Red Hat streams for Apache Kafka 2
- Red Hat streams for Apache Kafka 3
- Broken access control
- CVSS 8.1 High
Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
- Red Hat streams for Apache Kafka 3
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
- Red Hat streams for Apache Kafka 2
- Red Hat streams for Apache Kafka 3
- Authentication bypass
- CVSS 9.9 CriticalCritical · CVSS 9+
Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
- Red Hat StreamsHub Console for Apache Kafka®
- Red Hat streams for Apache Kafka 2
- Privilege escalation
- CVSS 7.7 High
Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
- Red Hat StreamsHub Console for Apache Kafka®
- Red Hat streams for Apache Kafka 2
- CWE-441
- CVSS 6.5 Medium
Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers
- Red Hat StreamsHub Console for Apache Kafka®
- Red Hat streams for Apache Kafka 2
- Code injection