{"id":"CVE-2026-105949","published":"2026-10-20T12:17:28.847","lastModified":"2026-10-23T12:18:06.253","description":"Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-105949","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510878","tags":[]},{"url":"https://github.com/cruise-control-for-kafka/cruise-control/commit/0680880be8483e87a39832de807b68d5e9918325","tags":[]}],"exploitRefs":[{"url":"https://github.com/cruise-control-for-kafka/cruise-control/commit/0680880be8483e87a39832de807b68d5e9918325","tags":[]}],"hasPoc":true,"ai":{"summary":"Cruise Control's Jetty ConstraintSecurityHandler fails to enforce authentication on admin endpoints due to incorrect path matching: it strips leading path segments and omits a catch-all wildcard constraint, allowing unauthenticated POST requests like /kafkacruisecontrol/x/rebalance to reach all 15 admin endpoints.","exploitability":"Exploitation is straightforward for an attacker with network access to the Cruise Control port (9090); no authentication or privileges are required, and public exploits exist.","blast_radius":"Successful exploitation grants full administrative control over Kafka clusters managed by Cruise Control, enabling data exfiltration, cluster reconfiguration, or denial of service across affected deployments.","remediation":"Upgrade to Cruise Control version 2.590 or later, which includes the fix for CVE-2026-105949.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","admin-endpoint-exposure","web","kafka"],"model":"garnet-coder","analyzedAt":"2026-10-26T09:01:57.276Z"}}