https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 20:55:38 +0000 https://db.gcve.eu/vuln/cve-2026-105949 <p><strong>Affected:</strong> Cruise Control for Apache Kafka, Red Hat streams for Apache Kafka 2, Red Hat streams for Apache Kafka 3</p> <p>Cruise Control&#39;s Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator&#39;s NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.</p> <p><strong>Affected:</strong> Cruise Control for Apache Kafka, Red Hat streams for Apache Kafka 2, Red Hat streams for Apache Kafka 3</p> <p>Cruise Control&#39;s Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator&#39;s NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.</p> https://db.gcve.eu/vuln/cve-2026-105949