Advisory · CVE-2026-105949
Cruise Control for Apache Kafka path handling bypasses authentication on all admin endpoints
Cruise Control registers Jetty security constraints on exact paths with no catch-all, while its servlet strips leading path segments before routing, so crafted paths reach all 15 admin endpoints without authentication. CVSS 3.1 8.8.
- Vendor
- Red Hat
- Product
- Cruise Control for Apache Kafka
- Identifier / CWE
- CVE-2026-105949
CWE-287 - Action timing
- Immediate
Explain it like I’m five
Cruise Control checks the exact hallway name on a badge list, but its router only reads the last word of the address, so adding a fake prefix walks an unauthenticated visitor straight into admin rooms.
- 01Crafted path sent
An attacker on an adjacent network sends a request with an extra leading segment, such as a rebalance path prefixed with a dummy segment.
- 02Constraint check missed
Jetty checks exact path specs with no catch-all wildcard constraint and uncovered methods are not denied, so the crafted path matches no protected constraint.
- 03Servlet routes by filename
The servlet strips the leading segments and dispatches on the final segment, reaching the admin endpoint.
- 04Admin endpoint reached unauthenticated
Per Red Hat, all 15 admin endpoints become reachable without authentication.
What happened
Red Hat disclosed CVE-2026-105949 in Cruise Control for Apache Kafka: the Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without denying uncovered HTTP methods (CWE-287). The servlet routes requests using only the final path segment, stripping leading segments and trailing slashes. The CVSS 3.1 score is 8.8, with adjacent network access, no privileges, and no user interaction required.
Per the affected data in the NVD record, Cruise Control versions 2.0.82 through before 3.1.0 are affected, and the product is also shipped in Red Hat streams for Apache Kafka 2 and 3. Red Hat notes that in AMQ Streams the Strimzi operator NetworkPolicy restricts Cruise Control port 9090 to operator pods only, which reduces effective exposure in that deployment pattern. No fixed version is claimed here beyond the affected range in the record; Red Hat guidance is the fix reference.
What to do
- Inventory Cruise Control deployments, including those bundled with Red Hat streams for Apache Kafka and standalone Kafka installations, and note the version of each.
- Apply vendor guidance from the Red Hat security page for CVE-2026-105949 for your deployment; confirm your version against the affected range in the record rather than assuming a fixed version.
- Restrict network access to the Cruise Control port to operator and admin hosts only while remediation is underway; do not expose it beyond the cluster or admin network.
- Hunt for requests with unexpected extra path segments before admin endpoint names, unauthenticated admin actions such as rebalance, and Cruise Control actions with no matching authenticated session.
- Verify the deployed version and that crafted prefixed paths are rejected after updating.
Management note
Cruise Control can rebalance and reshape a Kafka cluster. An unauthenticated path to its admin endpoints is a cluster-control risk, not a UI bug, so restrict its reachability today and patch Kafka platform deployments on the urgent ring.