CVE-2026-92751: CSRF Vulnerability in CMAK Allows Unauthenticated State Changes

CMAK (formerly Kafka Manager) versions 3.0.0.6 and earlier are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. The application fails to implement a CSRF filter, permitting an attacker to perform state-changing operations on behalf of an authenticated operator. The vulnerability persists because the application utilizes HTTP Basic authentication and session cookies that lack proper 'SameSite' attribute protections. An attacker can entice an authenticated administrator to visit a malicious site containing a hidden form, which subsequently submits unauthorized requests to sensitive endpoints within the CMAK interface, such as those responsible for deleting Kafka topics or modifying cluster configurations. This vulnerability poses a significant risk to the integrity and availability of managed Kafka clusters.

Impact

Successful exploitation allows an unauthenticated attacker to perform destructive administrative actions on managed Kafka clusters, including topic deletion and cluster configuration modification, leading to service disruption or unauthorized data manipulation.

Recommendation

• Prioritize upgrading CMAK to a version beyond 3.0.0.6 that includes CSRF protections.
• Implement restrictive CORS and SameSite cookie policies at the web server or reverse proxy level if immediate application patching is not feasible.
• Ensure that any administrative interfaces managing Kafka clusters are not exposed to the public internet and require additional layers of authentication or VPN access.