CVE-2026-92751 Overview
CVE-2026-92751 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting Yahoo's Cluster Manager for Apache Kafka (CMAK) through version 3.0.0.6. The application fails to install a CSRF filter, leaving state-changing endpoints unprotected. Attackers can craft hidden HTML forms that submit to destructive endpoints such as topic deletion and cluster configuration changes. The exploit leverages the authenticated operator's HTTP Basic authentication credentials or the play-basic-authentication cookie, which lacks SameSite protection. Successful exploitation requires a logged-in CMAK operator to visit an attacker-controlled page.
Critical Impact
Attackers can delete Kafka topics and alter cluster configuration by tricking an authenticated CMAK operator into loading a malicious page.
Affected Products
- Yahoo CMAK (Cluster Manager for Apache Kafka) through 3.0.0.6
- Deployments relying on HTTP Basic authentication in CMAK
- Deployments relying on the play-basic-authentication cookie in CMAK
Discovery Timeline
- 2026-09-16 - CVE-2026-92751 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92751
Vulnerability Analysis
CMAK is a web-based management interface for Apache Kafka clusters. Operators authenticate to the interface and perform administrative actions such as creating topics, deleting topics, and modifying cluster configuration. The application does not register a CSRF filter in its request pipeline, as referenced in the KafkaManagerLoader.scala initialization. State-changing HTTP endpoints therefore accept cross-origin requests when the browser attaches the operator's credentials automatically.
An attacker who knows or guesses the CMAK URL can host a page containing a hidden form targeting a destructive endpoint. When an authenticated operator loads the page, the browser submits the request along with the Authorization header or session cookie. CMAK processes the request as if the operator had initiated it. The impact extends to any administrative action exposed through the UI, including deletion of Kafka topics.
Root Cause
The root cause is the absence of a CSRF token filter in the Play framework request pipeline. The play-basic-authentication cookie is issued without the SameSite attribute, allowing browsers to attach it to cross-site requests. HTTP Basic credentials cached by the browser are similarly attached to unrelated origins. No origin, referer, or synchronizer token validation is performed on write operations.
Attack Vector
Exploitation requires user interaction from an authenticated operator. The attacker crafts a web page with an auto-submitting form pointing at a CMAK write endpoint. Delivery typically occurs through phishing links or watering-hole pages. Once the operator visits the page, the browser issues an authenticated POST request that CMAK executes without additional verification. Refer to the VulnCheck Advisory on CMAK CSRF and GitHub Issue #935 for endpoint-level details.
Detection Methods for CVE-2026-92751
Indicators of Compromise
- Unexpected Kafka topic deletions or configuration changes recorded in CMAK audit or application logs.
- CMAK requests with Referer or Origin headers pointing to external, non-corporate domains.
- POST requests to CMAK administrative endpoints without a preceding navigation from the CMAK UI.
Detection Strategies
- Inspect CMAK access logs for state-changing requests originating from browsers with cross-origin Referer headers.
- Correlate Kafka broker metadata changes with CMAK operator session activity to spot unattended administrative actions.
- Deploy web application firewall rules that flag POST requests to CMAK endpoints lacking a same-origin Referer.
Monitoring Recommendations
- Forward CMAK application logs and reverse-proxy access logs to a centralized logging platform for correlation.
- Alert on bulk topic deletions or cluster configuration edits within short time windows.
- Monitor operator workstation browsers for outbound requests to CMAK immediately after visits to untrusted domains.
How to Mitigate CVE-2026-92751
Immediate Actions Required
- Restrict CMAK access to trusted management networks through network segmentation or VPN.
- Require operators to use a dedicated browser profile for CMAK and log out immediately after use.
- Place CMAK behind a reverse proxy that enforces Origin and Referer validation on write requests.
Patch Information
No vendor patch is referenced in the advisory data for CMAK through 3.0.0.6. Track the Yahoo CMAK GitHub repository and GitHub Issue #935 for updates. Until an upstream fix is available, apply the workarounds below.
Workarounds
- Configure the reverse proxy to set the play-basic-authentication cookie with SameSite=Strict and Secure attributes.
- Block cross-origin POST requests to CMAK by rejecting requests whose Origin header does not match the CMAK hostname.
- Disable HTTP Basic authentication in favor of an SSO reverse proxy that issues short-lived, SameSite-scoped session cookies.
- Instruct operators to close CMAK browser sessions before browsing other sites, reducing the window for CSRF delivery.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.