Cruise Control: Authentication Bypass via Jetty ConstraintSecurityHandler (CVE-2026-105949)

CVE-2026-105949 is an authentication bypass vulnerability in the Cruise Control service, specifically affecting how it handles Jetty security constraints. The application utilizes a Jetty ConstraintSecurityHandler that registers constraints only on exact path specifications without catch-all wildcards or enabling the setDenyUncoveredHttpMethods(true) configuration. Consequently, the application fails to enforce security policies across all intended endpoints.

The vulnerability is compounded by the servlet routing logic, which uses Path.of(pathInfo).getFileName(). This method strips leading path segments and trailing slashes. By crafting requests (e.g., /kafkacruisecontrol/x/rebalance), an unauthenticated attacker can effectively neutralize path-based authentication checks. This leads to the exposure of 15 sensitive administrative endpoints, including those managing cluster rebalancing operations. While network-level mitigations such as Strimzi operator NetworkPolicy rules may limit exposure in certain deployment scenarios, the vulnerability permits full administrative control over the Cruise Control service if the port is reachable.

Impact

Successful exploitation allows unauthenticated attackers to invoke 15 administrative endpoints within the Cruise Control service. This impact includes the potential to trigger cluster-wide rebalancing, configuration modifications, or other sensitive operational actions without valid credentials. While organizations utilizing the Strimzi operator in AMQ Streams may benefit from inherent NetworkPolicy restrictions on port 9090, deployments with broader network accessibility are at high risk of unauthorized administrative actions.

Recommendation

1. Deploy infrastructure-level network access control lists (ACLs) or Kubernetes NetworkPolicies to restrict traffic to the Cruise Control port (9090) to authorized management pods only.
2. Implement application-layer logging to identify requests to administrative endpoints that lack associated authentication headers or tokens.
3. Patch the affected Cruise Control installation immediately once the vendor releases a version addressing the Jetty ConstraintSecurityHandler configuration.
4. Perform an audit of existing security constraints within the Jetty configuration to ensure catch-all patterns and denial of uncovered HTTP methods are explicitly defined.