CVE-2026-105311: Unintended Proxy or Intermediary ('Confused Deputy') in Red Hat StreamsHub Console for Apache Kafka®

The vulnerability arises from the StreamsHub Console operator acting as a confused deputy. A Kubernetes tenant authorized to create a Console custom resource can specify the kafkaUser.namespace field to point to any namespace. Since the operator has cluster-wide Secrets read permissions, it reads the KafkaUser Secret containing SASL credentials or TLS private keys from the victim namespace and writes the plaintext secret into a Secret in the attacker's namespace. The lack of same-namespace checks or allowlists in the code path enables this unauthorized secret disclosure.

An attacker with permission to create a Console custom resource can exfiltrate sensitive KafkaUser credentials (SASL or TLS private keys) from any namespace in the Kubernetes cluster. This leads to a confidentiality breach of critical authentication material, potentially allowing unauthorized access to Kafka clusters. The vulnerability does not impact integrity or availability directly but poses a significant risk to credential confidentiality.

No explicit patch or remediation details are provided in the vendor advisory link. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-105311 for current remediation guidance. Until a fix is available, restrict permissions to create Console custom resources and limit cluster-wide Secrets RBAC to trusted operators only.