CVE-2026-96740

Name of the Vulnerable Software and Affected Versions StreamsHub Console for Apache Kafka (affected versions not specified)

Description A flaw exists where tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys. This allows an author of the Console custom resource to manipulate the config.providers and bootstrap.servers variables to exfiltrate the console-api ServiceAccount token to a broker controlled by an attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.