CVE-2026-105949

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-105949
https://bugzilla.redhat.com/show_bug.cgi?id=2510878
https://github.com/cruise-control-for-kafka/cruise-control/commit/0680880be8483e87a39832de807b68d5e9918325

Configurations

No configuration.

History

23 Oct 2026, 12:18

Type	Values Removed	Values Added
References		() https://github.com/cruise-control-for-kafka/cruise-control/commit/0680880be8483e87a39832de807b68d5e9918325 -

20 Oct 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-20 12:17

Updated : 2026-10-23 12:18

NVD link : CVE-2026-105949

Mitre link : CVE-2026-105949

CVE.ORG link : CVE-2026-105949

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-105949", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105949", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-22T21:20:56.339490Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"versions": [{"status": "affected", "version": "2.0.82", "lessThan": "3.1.0", "versionType": "semver"}], "packageName": "Cruise Control for Apache Kafka", "collectionURL": "https://github.com/cruise-control-for-kafka/cruise-control", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:amq_streams:2"], "vendor": "Red Hat", "product": "streams for Apache Kafka 2", "packageName": "cruise-control", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:amq_streams:3"], "vendor": "Red Hat", "product": "streams for Apache Kafka 3", "packageName": "cruise-control", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-10-20T12:17:28.847", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-105949", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510878", "source": "secalert@redhat.com"}, {"url": "https://github.com/cruise-control-for-kafka/cruise-control/commit/0680880be8483e87a39832de807b68d5e9918325", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important."}], "lastModified": "2026-10-23T12:18:06.253", "sourceIdentifier": "secalert@redhat.com"}