{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3astrimzistrimzi_kafka_operator/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:strimzi:strimzi_kafka_operator:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-105312"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-105312\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Strimzi Operator"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Strimzi"],"content_html":"\u003cp\u003eCVE-2026-105312 is a security vulnerability in the Strimzi Kubernetes operator that allows for cross-tenant privilege escalation. A tenant with 'create' permissions on Console custom resources can manipulate the 'spec.containers.api.spec.image' field, forcing the operator to deploy an arbitrary container image under its control. The operator subsequently deploys this image into a pod associated with a ServiceAccount that has high-privilege access, including cluster-wide get, list, and watch permissions on all Strimzi Custom Resource Definitions (CRDs) such as KafkaUsers, as well as patch permissions on Kafkas and KafkaRebalances. An attacker exploiting this can read the projected ServiceAccount token from within the container to gain unauthorized control-plane access, effectively bypassing tenant isolation to read or modify Kafka resources across the cluster.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a Kubernetes namespace where they possess 'create' permissions on Console custom resources.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious Console custom resource definition containing a crafted 'spec.containers.api.spec.image' value pointing to an attacker-controlled container image.\u003c/li\u003e\n\u003cli\u003eAttacker submits the malicious Console custom resource to the Kubernetes API server.\u003c/li\u003e\n\u003cli\u003eThe Strimzi operator reconciles the malicious resource and pulls the attacker-controlled image.\u003c/li\u003e\n\u003cli\u003eThe Strimzi operator deploys the malicious image into a pod context managed by the operator.\u003c/li\u003e\n\u003cli\u003eThe pod initializes with a ServiceAccount bound via ClusterRoleBinding to a high-privilege Strimzi ClusterRole.\u003c/li\u003e\n\u003cli\u003eAttacker executes code within the running container to access the projected ServiceAccount token located in the filesystem.\u003c/li\u003e\n\u003cli\u003eAttacker uses the stolen ServiceAccount token to perform unauthorized cross-tenant operations, such as modifying KafkaUsers or Kafka resources.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged tenant to gain elevated, cluster-wide control over Strimzi Kafka deployments. This results in unauthorized access to sensitive Kafka data, the ability to modify or delete Kafka users and cluster configurations, and potential disruption to cross-tenant messaging services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAudit Kubernetes RBAC policies to restrict 'create' permissions on Console custom resources to trusted administrative principals only.\u003c/li\u003e\n\u003cli\u003eImplement admission controllers to validate image registry sources for pods created by operators, ensuring only authorized container images are deployed.\u003c/li\u003e\n\u003cli\u003eReview existing ClusterRoleBindings associated with Strimzi ServiceAccounts to ensure they adhere to the principle of least privilege.\u003c/li\u003e\n\u003cli\u003eUpgrade to the latest patched version of the Strimzi operator as provided by the vendor.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T14:43:19Z","date_published":"2026-10-20T13:07:54Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-105312/","summary":"CVE-2026-105312 is a high-severity privilege escalation vulnerability allowing a tenant to perform cross-tenant Strimzi control-plane actions by injecting arbitrary container images into privileged operator-managed pods.","title":"Strimzi: Privilege escalation via Console custom resource image injection (CVE-2026-105312)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-105312/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:strimzi:strimzi_kafka_operator:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}