Security Bypass in Cruise Control's Jetty ConstraintSecurityHandler
CVE-2026-105949

8.8HIGH

Key Information:

Status
Streams For Apache Kafka 2
Streams For Apache Kafka 3
Vendor
CVE Published:
20 October 2026

What is CVE-2026-105949?

The Jetty ConstraintSecurityHandler in Cruise Control improperly registers security constraints, allowing requests to bypass authentication for admin endpoints. Specifically, requests like POST /kafkacruisecontrol/x/rebalance can access sensitive admin functionalities without proper authorization, as no wildcard catch-all constraint exists and uncovered HTTP methods are not restricted. Although the effective risk is somewhat mitigated by AMQ Streams' NetworkPolicy, all 15 admin endpoints remain vulnerable to unauthenticated access.

References

https://access.redhat.com/security/cve/CVE-2026-105949
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2510878
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.