CVE-2026-92778 describes a vulnerability in Yahoo's CMAK product up to version 3.0.0.6 where the scheduled leader election feature toggle is not applied to HTML form routes. This flaw enables attackers to access form endpoints that control starting and stopping the recurring election scheduler, thereby disrupting leadership management across Kafka clusters. The vulnerability requires low attack complexity and no user interaction but does require some privileges.

Attackers with limited privileges can bypass the feature toggle to start or stop the recurring election scheduler via HTML form endpoints. This can disrupt leadership roles within managed Kafka clusters, potentially affecting cluster stability and availability. There is no indication of data confidentiality or integrity compromise beyond leadership disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected HTML form routes to trusted users only and monitor for unauthorized attempts to manipulate the election scheduler.