Yahoo CMAK through version 3.0.0.6 does not install a CSRF filter, allowing attackers to craft hidden forms that submit requests to sensitive endpoints. These requests can cause destructive actions like deleting topics or changing cluster configurations by exploiting the operator's authenticated session via HTTP Basic authentication or cookies without SameSite flags. This vulnerability enables unauthorized state changes without requiring the attacker to have direct access to credentials.

An attacker can perform unauthorized state-changing operations on behalf of authenticated operators, potentially leading to destructive changes such as topic deletions and cluster configuration modifications. This compromises the integrity and availability of the affected system's configuration and data management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing additional CSRF protections at the application or network level and avoid using vulnerable versions where possible.