Kritik CVSS 9.9
CVE-2026-105312: CVE-2026-105312: hatalı yetki yönetimi
Açıklama (NVD)
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
Özet bilgiler
- CVSS v3.1
- 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - EPSS
- %0,34 (yüzdelik 27)
- CWE
- CWE-269
- Yama
- Yok / bilinmiyor