{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acruise_control_projectcruise_control/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cruise_control_project:cruise_control:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-105949"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-105949\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Cruise Control"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","auth-bypass","cve-2026-105949"],"_cs_type":"advisory","_cs_vendors":["Cruise Control"],"content_html":"\u003cp\u003eCVE-2026-105949 is an authentication bypass vulnerability in the Cruise Control service, specifically affecting how it handles Jetty security constraints. The application utilizes a Jetty ConstraintSecurityHandler that registers constraints only on exact path specifications without catch-all wildcards or enabling the setDenyUncoveredHttpMethods(true) configuration. Consequently, the application fails to enforce security policies across all intended endpoints.\u003c/p\u003e\n\u003cp\u003eThe vulnerability is compounded by the servlet routing logic, which uses Path.of(pathInfo).getFileName(). This method strips leading path segments and trailing slashes. By crafting requests (e.g., /kafkacruisecontrol/x/rebalance), an unauthenticated attacker can effectively neutralize path-based authentication checks. This leads to the exposure of 15 sensitive administrative endpoints, including those managing cluster rebalancing operations. While network-level mitigations such as Strimzi operator NetworkPolicy rules may limit exposure in certain deployment scenarios, the vulnerability permits full administrative control over the Cruise Control service if the port is reachable.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to invoke 15 administrative endpoints within the Cruise Control service. This impact includes the potential to trigger cluster-wide rebalancing, configuration modifications, or other sensitive operational actions without valid credentials. While organizations utilizing the Strimzi operator in AMQ Streams may benefit from inherent NetworkPolicy restrictions on port 9090, deployments with broader network accessibility are at high risk of unauthorized administrative actions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy infrastructure-level network access control lists (ACLs) or Kubernetes NetworkPolicies to restrict traffic to the Cruise Control port (9090) to authorized management pods only.\u003c/li\u003e\n\u003cli\u003eImplement application-layer logging to identify requests to administrative endpoints that lack associated authentication headers or tokens.\u003c/li\u003e\n\u003cli\u003ePatch the affected Cruise Control installation immediately once the vendor releases a version addressing the Jetty ConstraintSecurityHandler configuration.\u003c/li\u003e\n\u003cli\u003ePerform an audit of existing security constraints within the Jetty configuration to ensure catch-all patterns and denial of uncovered HTTP methods are explicitly defined.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T14:43:18Z","date_published":"2026-10-20T13:08:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cruise-control-jetty-bypass/","summary":"CVE-2026-105949 is an authentication bypass vulnerability in Cruise Control due to improper security constraint configuration and flawed servlet path routing, allowing unauthenticated access to admin endpoints.","title":"Cruise Control: Authentication Bypass via Jetty ConstraintSecurityHandler (CVE-2026-105949)","url":"https://feed.craftedsignal.io/briefs/2026-10-cruise-control-jetty-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:cruise_control_project:cruise_control:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}