Arbitrary Container Image Deployment in Kubernetes by Strimzi Vendor

CVE-2026-105312

What is CVE-2026-105312?

A vulnerability exists in Kubernetes where a tenant with permission to create Console custom resources can specify an arbitrary container image. This leads to the deployment of malicious code within a pod. The compromised pod can read the projected ServiceAccount token and gain unauthorized access to the Strimzi control plane, enabling the attacker to manipulate KafkaUsers and other sensitive resources cluster-wide. This vulnerability poses significant risks to secure data management and inter-tenant isolation.

References