CVE-2026-105949: Improper Authentication in Red Hat streams for Apache Kafka 2

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specifications without a catch-all wildcard and does not enable denyUncoveredHttpMethods. The servlet routes requests by extracting only the filename from the path, which strips leading path segments and trailing slashes. This allows crafted requests such as POST /kafkacruisecontrol/x/rebalance to bypass authentication entirely, granting unauthenticated access to all 15 admin endpoints. In AMQ Streams, the Strimzi operator applies a NetworkPolicy that restricts access to port 9090 to operator pods only, mitigating the risk in those environments.

An attacker can bypass authentication to access all administrative endpoints of Cruise Control, potentially leading to full compromise of confidentiality, integrity, and availability of the affected service. The CVSS score is 8.8 (high severity). However, in AMQ Streams deployments, the NetworkPolicy reduces the risk by limiting access to the vulnerable port to trusted operator pods.

Check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-105949 for official remediation guidance. The advisory does not explicitly state patch availability; therefore, patch status is not yet confirmed—consult the vendor advisory for current remediation. In AMQ Streams environments, the existing NetworkPolicy restricting port 9090 access to operator pods mitigates the vulnerability. Users should verify and enforce similar network restrictions if applicable.