{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/streamshub/console","packageName":"console","product":"StreamsHub Console for Apache Kafka®","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"0.12.9","status":"affected","version":"0.2.1","versionType":"semver"},{"lessThan":"0.14.1","status":"affected","version":"0.13.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"console-operator","product":"streams for Apache Kafka 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"console-operator","product":"streams for Apache Kafka 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-96740","cwes":["CWE-470"],"description":"A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.","epss":{"date":"2026-11-03","percentile":0.35055,"score":0.00407},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793727758420,"publishedAt":1790616464240,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-96740"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539427"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/advisories/GHSA-3rpr-3qjq-fg52"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/streamshub/console/commit/d45897e12"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/streamshub/console/commit/ef13971"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/streamshub/console/pull/2957"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Restrict `create`, `update`, and `patch` permissions for Console custom resources to trusted administrators only. Where supported, apply a NetworkPolicy to restrict Console API egress to approved Kafka broker endpoints. These controls reduce exposure to the reported ServiceAccount-credential disclosure path but do not replace the permanent fix, which is to filter security-sensitive Kafka client properties. Upgrade to a release containing the permanent fix when available."}],"revision":"85bad30d886c27f687e8bcccde999319cb672113a8087550b36473c530419db2","sources":[{"modifiedAt":1793727758420,"name":"CNA: redhat","retrievedAt":1793729463881,"url":"https://www.cve.org/CVERecord?id=CVE-2026-96740"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793729466204,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96740"}],"ssvc":{"assessedAt":1790797317966,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers","updatedAt":1793729466204}