Threats affecting pkg:github/yahoo/CMAK

CMAK versions up to 3.0.0.6 have a protection mechanism failure where the scheduled leader election feature toggle is not applied to HTML form routes. This allows attackers with limited privileges to access form endpoints that control the recurring election scheduler, potentially disrupting leadership in managed Kafka clusters. The vulnerability has a medium severity score of 5.3 and does not have known exploits in the wild. No patch or official fix information is provided in the available data.

CVE-2026-92751 is a high-severity cross-site request forgery (CSRF) vulnerability in Yahoo CMAK versions up to 3.0.0.6. The software fails to implement a CSRF filter, allowing attackers to perform unauthorized state-changing actions on behalf of authenticated operators. Exploitation involves crafting hidden forms that submit destructive requests, such as topic deletion or cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or cookies without SameSite protection.