{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acmak_projectcmak/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cmak_project:cmak:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-92751"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CMAK (\u003c= 3.0.0.6)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["CMAK"],"content_html":"\u003cp\u003eCMAK (formerly Kafka Manager) versions 3.0.0.6 and earlier are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. The application fails to implement a CSRF filter, permitting an attacker to perform state-changing operations on behalf of an authenticated operator. The vulnerability persists because the application utilizes HTTP Basic authentication and session cookies that lack proper 'SameSite' attribute protections. An attacker can entice an authenticated administrator to visit a malicious site containing a hidden form, which subsequently submits unauthorized requests to sensitive endpoints within the CMAK interface, such as those responsible for deleting Kafka topics or modifying cluster configurations. This vulnerability poses a significant risk to the integrity and availability of managed Kafka clusters.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to perform destructive administrative actions on managed Kafka clusters, including topic deletion and cluster configuration modification, leading to service disruption or unauthorized data manipulation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize upgrading CMAK to a version beyond 3.0.0.6 that includes CSRF protections.\u003c/li\u003e\n\u003cli\u003eImplement restrictive CORS and SameSite cookie policies at the web server or reverse proxy level if immediate application patching is not feasible.\u003c/li\u003e\n\u003cli\u003eEnsure that any administrative interfaces managing Kafka clusters are not exposed to the public internet and require additional layers of authentication or VPN access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-16T23:51:44Z","date_published":"2026-09-16T23:51:44Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cmak-csrf/","summary":"CMAK versions up to 3.0.0.6 are vulnerable to Cross-Site Request Forgery (CSRF) due to missing request filters, enabling attackers to execute unauthorized actions like cluster deletion or configuration changes.","title":"CVE-2026-92751: CSRF Vulnerability in CMAK Allows Unauthenticated State Changes","url":"https://feed.craftedsignal.io/briefs/2026-09-cmak-csrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:cmak_project:cmak:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}