CVE-2026-105312

Summary

A Kubernetes tenant with limited create permissions can escalate privileges by deploying a malicious container image that gains access to cluster-wide Strimzi CRD operations through a misconfigured ServiceAccount binding. This allows attackers to read and modify Kafka resources across all tenants.

Exploitability

Exploitation requires a tenant with create permission on Console custom resources, which is moderately easy to achieve, and involves deploying a container that reads the projected service account token to gain cluster-wide access.

Blast radius

The impact could be severe as attackers gain cross-tenant read+write access to Strimzi control-plane resources including KafkaUsers, Kafkas, and KafkaRebalances, potentially leading to data exposure or disruption across multiple tenant environments.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Restrict the ClusterRoleBinding that grants cluster-wide permissions to specific namespaces instead of allowing it to apply cluster-wide, or upgrade to version 2.590 or later if available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.