CVE-2026-105941: Server-Side Request Forgery (SSRF) in Red Hat streams for Apache Kafka 3

The vulnerability in Red Hat streams for Apache Kafka 3 involves the Azure Key Vault KMS provider accepting an untrusted vaultName parameter from wire-deserialized EDEK bytes without validating its format. This Server-Side Request Forgery (SSRF) enables an attacker to exfiltrate the Azure bearer token used by the proxy. The stolen token can then be replayed against the actual Azure Key Vault, undermining the security guarantees of the record-encryption trust model. The CVSS v3.1 score is 8.1 (high severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality and integrity impacts. The vulnerability affects the cloud-hosted service, and Red Hat manages remediation server-side.

An attacker can exploit this SSRF vulnerability to steal the Azure bearer token from the proxy, allowing unauthorized access to the Azure Key Vault. This compromises the confidentiality and integrity of encrypted records by defeating the record-encryption trust model. There is no impact on availability reported. The vulnerability has a high severity rating with a CVSS score of 8.1.

Red Hat manages remediation for this cloud-hosted service and has made a patch available. Users should refer to the official Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-105941 for detailed remediation instructions and ensure their service instances are updated accordingly. Since this is a cloud service, the vendor typically applies fixes server-side, so no direct user action may be required beyond verifying the update status.