CVE-2026-105311: StreamsHub Console Privilege Escalation

CVE-2026-105311 Overview

The StreamsHub Console operator contains a confused deputy vulnerability [CWE-441] that enables cross-namespace secret theft in Kubernetes clusters. A tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator runs with cluster-wide Secrets RBAC and reads the referenced KafkaUser Secret from the victim namespace. It then writes the plaintext SASL credentials or TLS private keys into a Secret inside the attacker's namespace. The code path contains no same-namespace check and no allowlist enforcement.

Critical Impact

Any authenticated tenant able to create Console resources can exfiltrate Kafka SASL credentials and TLS private keys from any namespace in the cluster.

Affected Products

• StreamsHub Console operator (Kubernetes operator for Apache Kafka management)
• Red Hat distributions referencing Red Hat CVE-2026-105311 Advisory
• See Red Hat Bug Report #2510875 for tracking details

Discovery Timeline

• 2026-10-20 - CVE-2026-105311 published to NVD
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-105311

Vulnerability Analysis

The StreamsHub Console operator reconciles Console custom resources submitted by cluster tenants. Each Console resource references one or more Kafka clusters and the associated KafkaUser credentials. The operator fetches those credential Secrets so the Console workload can authenticate to Kafka brokers.

The flaw stems from the operator honoring a caller-supplied namespace field on the credential reference without validating it against the Console resource's own namespace. Because the operator holds cluster-wide get and list permissions on Secrets, it reads any Secret the caller names. The operator then materializes the retrieved SASL password or TLS key as a new Secret inside the attacker-controlled namespace, where the attacker already has read access.

Exploitation does not require breaking authentication or exploiting a memory corruption bug. The attacker submits a benign-looking Console resource whose kafkaUser.namespace points at a victim tenant, then reads the resulting Secret from their own namespace.

Root Cause

The operator trusts tenant-controlled input to select the source namespace for sensitive Secret reads. Two controls are missing: a check that the credential namespace matches the Console resource namespace, and an allowlist of permitted source namespaces. The combination of unvalidated input and cluster-wide RBAC creates the confused deputy condition described in [CWE-441].

Attack Vector

The attacker needs only the ability to create a Console custom resource in a namespace they already control. They craft the resource with spec.kafkaClusters[0].credentials.kafkaUser.namespace set to the target namespace and name set to the known KafkaUser Secret. The operator reconciles the resource, reads the victim Secret with its cluster-wide service account, and writes the plaintext material into a Secret in the attacker's namespace. The attacker retrieves the Secret with standard kubectl get secret -o yaml access.

See the Red Hat CVE-2026-105311 Advisory for implementation specifics.

Detection Methods for CVE-2026-105311

Indicators of Compromise

• Console custom resources whose spec.kafkaClusters[].credentials.kafkaUser.namespace differs from the resource's own metadata.namespace.
• New Secrets appearing in tenant namespaces whose names or data match KafkaUser Secrets from unrelated namespaces.
• Operator service account get or list calls against Secrets in namespaces outside its intended scope.

Detection Strategies

• Audit the Kubernetes API server log for create and update events on Console resources, flagging any cross-namespace credential references.
• Compare the data hashes of KafkaUser Secrets across namespaces to find duplicates written by the operator.
• Run a scheduled job that lists Console resources cluster-wide and reports any whose credential namespace does not equal the resource namespace.

Monitoring Recommendations

• Enable Kubernetes audit policy at Metadata level or higher for secrets and consoles.streamshub.github.com resources.
• Forward audit logs to a SIEM and alert on Secret reads performed by the StreamsHub operator service account outside expected namespaces.
• Track creation of Console CRs in multi-tenant clusters and require review for any resource referencing a foreign namespace.

How to Mitigate CVE-2026-105311

Immediate Actions Required

• Restrict create and update permissions on consoles.streamshub.github.com to trusted administrators until a patched operator is deployed.
• Rotate all KafkaUser SASL passwords and TLS private keys that may have been exposed through the operator.
• Review existing Secrets in tenant namespaces and delete any copies of KafkaUser credentials that did not originate there.

Patch Information

Monitor the Red Hat CVE-2026-105311 Advisory and Red Hat Bug Report #2510875 for fixed operator versions. Apply the fixed release as soon as it is available in your distribution channel.

Workarounds

• Deploy a Kubernetes admission policy (OPA Gatekeeper, Kyverno, or ValidatingAdmissionPolicy) that rejects Console resources where spec.kafkaClusters[].credentials.kafkaUser.namespace is set to any value other than metadata.namespace.
• Scope the operator's Secrets RBAC to a narrow allowlist of namespaces rather than cluster-wide, if the deployment model allows it.
• Isolate tenants in dedicated clusters when strong namespace isolation of Kafka credentials cannot be guaranteed.

# Kyverno policy enforcing same-namespace KafkaUser references
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: streamshub-console-same-namespace
spec:
  validationFailureAction: Enforce
  rules:
    - name: block-cross-namespace-kafkauser
      match:
        any:
          - resources:
              kinds:
                - consoles.streamshub.github.com/v1alpha1/Console
      validate:
        message: "kafkaUser.namespace must equal the Console resource namespace"
        foreach:
          - list: "request.object.spec.kafkaClusters"
            deny:
              conditions:
                any:
                  - key: "{{ element.credentials.kafkaUser.namespace }}"
                    operator: NotEquals
                    value: "{{ request.object.metadata.namespace }}"