CVE-2026-105949

Full vulnerability record from the local CVENow database.

Description

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-20 12:17:28.847000

Last modified

2026-10-23 12:18:06.253000

View original CVE JSON

{
  "id": "CVE-2026-105949",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-20T12:17:28.847",
  "lastModified": "2026-10-23T12:18:06.253",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/cruise-control-for-kafka/cruise-control",
          "packageName": "Cruise Control for Apache Kafka",
          "versions": [
            {
              "version": "2.0.82",
              "lessThan": "3.1.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "streams for Apache Kafka 2",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cruise-control",
          "cpes": [
            "cpe:/a:redhat:amq_streams:2"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "streams for Apache Kafka 3",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cruise-control",
          "cpes": [
            "cpe:/a:redhat:amq_streams:3"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-22T21:20:56.339490Z",
          "id": "CVE-2026-105949",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-105949",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510878",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/cruise-control-for-kafka/cruise-control/commit/0680880be8483e87a39832de807b68d5e9918325",
      "source": "[email protected]"
    }
  ]
}