The vulnerability arises from unfiltered tenant-supplied Kafka client properties being incorporated into the console-api AdminClient configuration in the StreamsHub Console for Apache Kafka. This lack of filtering permits a Console custom resource author to manipulate config.providers and bootstrap.servers settings to exfiltrate the console-api ServiceAccount token to a broker controlled by an attacker. The issue is classified under CWE-470 (Use of Externally-Controlled Input to Select Classes or Code, 'Unsafe Reflection'). Red Hat's assessment states this flaw does not impact any currently supported Red Hat products. Mitigation involves restricting create, update, and patch permissions on Console custom resources to trusted administrators and applying NetworkPolicy to restrict Console API egress to approved Kafka brokers. The permanent fix will filter security-sensitive Kafka client properties in a future release.

The vulnerability can lead to unauthorized disclosure of the console-api ServiceAccount token by allowing an attacker to exfiltrate it to an attacker-controlled Kafka broker. This compromises confidentiality by exposing sensitive credentials. There is also potential for unauthorized code execution or altered execution logic due to unsafe reflection. Denial of service impacts such as crashes or hangs may occur if the wrong code is invoked with unexpected arguments. However, Red Hat states no currently supported products are affected by this vulnerability.

Red Hat recommends restricting create, update, and patch permissions for Console custom resources to trusted administrators only. Where supported, apply NetworkPolicy to restrict Console API egress traffic to approved Kafka broker endpoints. These mitigations reduce exposure to ServiceAccount token disclosure but do not replace the permanent fix. Users should upgrade to a release containing the permanent fix when it becomes available, which will filter security-sensitive Kafka client properties.