CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set…
- Risk score
- 75/100
- CVSS
- 9.9 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A Kubernetes tenant with create permission on Console custom resources can set an arbitrary container image, allowing an attacker to gain cross-tenant Strimzi control-plane read+write access. This is due to a vulnerability in the way Console custom resources are handled.
- Affected
- {'products': ['Kubernetes'], 'packages': [], 'versions': ['affected by Console custom resource vulnerability']}
- Fix
- Check the linked advisory for details on mitigation and potential fixes.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.9 critical
- On your watchlist: kubernetes
References
Original description
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
Last activity 20 Oct 2026. Patch Forecast updates every hour.