← Back to search

CVE-2026-105949

8.8 HIGHpublic exploit available

Published 2026-10-20 · Updated 2026-10-23

AI risk analysis

Summary
Cruise Control's Jetty ConstraintSecurityHandler fails to enforce authentication on admin endpoints due to incorrect path matching: it strips leading path segments and omits a catch-all wildcard constraint, allowing unauthenticated POST requests like /kafkacruisecontrol/x/rebalance to reach all 15 admin endpoints.
Exploitability
Exploitation is straightforward for an attacker with network access to the Cruise Control port (9090); no authentication or privileges are required, and public exploits exist.
Blast radius
Successful exploitation grants full administrative control over Kafka clusters managed by Cruise Control, enabling data exfiltration, cluster reconfiguration, or denial of service across affected deployments.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to Cruise Control version 2.590 or later, which includes the fix for CVE-2026-105949.
auth-bypassadmin-endpoint-exposurewebkafka

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.