CVE-2026-92780 Overview
CVE-2026-92780 is a missing authorization vulnerability [CWE-862] in KnowStreaming through version 3.4.1, an open-source Kafka management platform maintained by Didi. The application fails to enforce role-based access control (RBAC) on its REST API endpoints. Any authenticated user, regardless of assigned role, can invoke privileged identity-management endpoints. Attackers can create new administrator accounts or elevate their own account to administrative privileges without authorization. The flaw resides in the PermissionInterceptor component, which does not validate role membership before permitting access to sensitive operations.
Critical Impact
Any low-privileged authenticated user can escalate to administrator, gaining full control over KnowStreaming and the managed Kafka clusters.
Affected Products
- KnowStreaming through version 3.4.1
- KnowStreaming km-rest module (PermissionInterceptor)
- Deployments using default RBAC configuration
Discovery Timeline
- 2026-09-16 - CVE-2026-92780 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92780
Vulnerability Analysis
KnowStreaming exposes REST endpoints that manage users, roles, and cluster configuration. The PermissionInterceptor class is intended to authorize requests before they reach controller methods. Review of the source at PermissionInterceptor.java lines 46-74 shows the interceptor checks for a valid authenticated session but does not compare the caller's role against the role required by the endpoint. As a result, endpoints marked for administrative use are reachable by any authenticated principal.
An attacker with a standard user account can call identity-management APIs to create new admin users or promote themselves. Once administrative access is obtained, the attacker controls Kafka topic configuration, ACLs, cluster metadata, and connected data pipelines. This is a vertical privilege escalation with broad downstream impact on Kafka workloads managed by the platform.
Root Cause
The interceptor implements authentication but omits authorization logic. There is no mapping between the requested route or annotation and the caller's role set. The vulnerability is classified under CWE-862: Missing Authorization. See the tracking discussion in GitHub Issue #1263 and the VulnCheck Security Advisory.
Attack Vector
Exploitation requires network reachability to the KnowStreaming REST API and any valid low-privileged credential. The attacker authenticates, then issues an HTTP request to a user-management endpoint to create an administrator or update their own role. No user interaction is required, and the attack complexity is low. Refer to the KnowStreaming repository for endpoint definitions.
Detection Methods for CVE-2026-92780
Indicators of Compromise
- Unexpected creation of new user accounts with administrator role in KnowStreaming audit logs.
- Role modification events where a non-admin account is promoted to admin.
- REST API calls to identity or user-management endpoints originating from accounts that historically only performed read operations.
- New or modified Kafka ACLs, topic configurations, or connector definitions following suspicious user changes.
Detection Strategies
- Correlate authentication logs with subsequent calls to /api/v3/users or role-assignment endpoints to identify privilege escalation attempts.
- Alert on HTTP requests to administrative REST paths where the authenticated session's role is not admin.
- Baseline normal per-user API usage and flag deviations, especially calls to identity-management routes.
Monitoring Recommendations
- Enable and centralize KnowStreaming application logs and Kafka broker audit logs in a SIEM.
- Monitor for role-change and user-creation events and require ticket correlation for each occurrence.
- Track outbound requests from the KnowStreaming host to detect follow-on abuse of newly gained admin access.
How to Mitigate CVE-2026-92780
Immediate Actions Required
- Restrict network access to the KnowStreaming REST API to trusted management networks and administrators only.
- Audit all user accounts and remove any unrecognized administrator accounts or unexpected role assignments.
- Rotate credentials for all KnowStreaming users and reset API tokens after auditing.
- Review Kafka ACLs, topics, and connectors for unauthorized changes made through the platform.
Patch Information
No fixed version is listed in the NVD entry at time of publication. The vulnerability affects KnowStreaming through 3.4.1. Monitor the KnowStreaming GitHub repository and GitHub Issue #1263 for a patched release, and consult the VulnCheck advisory for updated guidance.
Workarounds
- Place the KnowStreaming console behind a reverse proxy or VPN that enforces authorization at the network layer.
- Apply web application firewall rules to block non-admin sessions from reaching identity-management endpoints.
- Disable or remove non-essential user accounts to reduce the pool of credentials an attacker could use to authenticate.
- Implement compensating controls in PermissionInterceptor by adding explicit role checks if maintaining a local fork.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.