CVE-2026-92778: CMAK Authentication Bypass Vulnerability

CVE-2026-92778 Overview

CMAK (Cluster Manager for Apache Kafka) through version 3.0.0.6 contains a feature gate bypass vulnerability in its scheduled leader election functionality. The application fails to apply the scheduled leader election feature toggle to HTML form routes. Authenticated attackers can access form endpoints to start and stop the recurring election scheduler. This disrupts leadership across managed Kafka clusters, even when administrators have explicitly disabled the feature. The flaw is tracked under CWE-693: Protection Mechanism Failure and affects Yahoo's open-source Kafka management interface.

Critical Impact

Attackers with low-privilege access can trigger unauthorized preferred replica elections across Kafka clusters, degrading availability and consistency of managed brokers.

Affected Products

• Yahoo CMAK (Cluster Manager for Apache Kafka) versions up to and including 3.0.0.6
• Deployments exposing the PreferredReplicaElection controller routes
• Kafka clusters managed through CMAK web interface

Discovery Timeline

• 2026-09-16 - CVE-2026-92778 published to NVD
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92778

Vulnerability Analysis

CMAK implements a scheduled leader election feature that can be toggled on or off through application configuration. The feature gate is intended to prevent unauthorized use of the recurring election scheduler, which triggers preferred replica elections across Kafka clusters at defined intervals.

The vulnerability stems from inconsistent enforcement of this feature toggle. While the toggle is properly evaluated on some code paths, the HTML form routes in the PreferredReplicaElection controller do not honor the same gate. An authenticated user can submit HTTP POST requests to the form endpoints and manipulate the scheduler regardless of the configured toggle state.

Exploitation grants the attacker the ability to start or stop the recurring election scheduler on demand. Triggered elections force leadership reassignment across Kafka broker partitions. Repeated or malicious invocation causes leadership churn, degrades producer and consumer throughput, and can destabilize downstream applications that depend on stable partition leadership.

Root Cause

The root cause is a missing protection mechanism check on specific controller routes. The scheduled election feature toggle is enforced on API routes but not on the corresponding HTML form routes. See the PreferredReplicaElection.scala source for the affected handler logic.

Attack Vector

An authenticated attacker with low privileges sends crafted HTTP POST requests to the CMAK HTML form endpoints that control the scheduled leader election. Because the feature toggle is not evaluated for these routes, the request succeeds even when scheduled elections are disabled by policy. No user interaction is required beyond the attacker's own request submission.

See the VulnCheck CMAK Advisory and GitHub Issue #936 for additional technical detail.

Detection Methods for CVE-2026-92778

Indicators of Compromise

• Unexpected HTTP POST requests to CMAK PreferredReplicaElection form routes from non-administrative users
• Kafka broker logs showing frequent or unscheduled preferred replica election events
• CMAK application logs recording scheduler start/stop transitions inconsistent with configured policy

Detection Strategies

• Correlate CMAK web access logs with Kafka controller logs to identify election events originating from unauthorized user sessions
• Alert on any invocation of the recurring election scheduler when the feature toggle is configured as disabled
• Baseline normal partition leadership change rates and flag statistical anomalies indicating induced churn

Monitoring Recommendations

• Forward CMAK access logs and Kafka controller logs to a centralized SIEM for cross-source correlation
• Monitor authentication events for the CMAK console and enrich them with user role context
• Track partition leader change frequency per cluster and per topic to detect abnormal reassignment patterns

How to Mitigate CVE-2026-92778

Immediate Actions Required

• Restrict network access to the CMAK web interface using firewall rules or a reverse proxy allowlist
• Enforce strong authentication and audit all accounts with access to the CMAK console
• Review Kafka partition leadership metrics for signs of unauthorized election activity

Patch Information

No official vendor patch is referenced in the advisory at the time of publication. Track the Yahoo CMAK repository and GitHub Issue #936 for remediation status. Until a fix is available, apply the compensating controls described below.

Workarounds

• Place CMAK behind an authenticating reverse proxy that blocks POST requests to the PreferredReplicaElection form endpoints for non-administrative users
• Limit CMAK console access to a small set of trusted operator accounts and remove unnecessary user accounts
• Deploy CMAK on an isolated management network segment inaccessible from general user networks

# Example NGINX reverse proxy rule to block form POSTs to the affected controller
location ~* ^/preferredReplicaElection/ {
    limit_except GET {
        allow 10.0.0.0/24;   # admin subnet
        deny all;
    }
    proxy_pass http://cmak_backend;
}