A vulnerability in the StreamsHub Console for Apache Kafka allows a Console custom resource author to exfiltrate sensitive credentials by setting certain Kafka client properties without filtering security-sensitive keys. This flaw leads to unauthorized disclosure of the console-api ServiceAccount token to an attacker-controlled Kafka broker. The issue arises because tenant-supplied Kafka client properties are copied directly into the console-api AdminClient configuration without proper filtering.