What is GHSA-5c9w-jj2v-89qh?

GHSA-5c9w-jj2v-89qh is a security advisory published by GitHub Security Advisories with Critical severity. A Kubernetes tenant with create permission on Console custom resources can set spec.containers...

Which CVE IDs does GHSA-5c9w-jj2v-89qh cover?

GHSA-5c9w-jj2v-89qh covers the following CVE IDs: CVE-2026-105312. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5c9w-jj2v-89qh?

GHSA-5c9w-jj2v-89qh has a CVSS v3 base score of 9.9, published by GitHub Security Advisories.

GHSA-5c9w-jj2v-89qhCriticalCVSS 9.9

A Kubernetes tenant with create permission on Console custom resources can set spec.containers...

Vendor

GitHub Security Advisories

Published

October 20, 2026

Last Modified

October 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-105312 →

📋 Description

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-105312
https://access.redhat.com/security/cve/CVE-2026-105312
https://bugzilla.redhat.com/show_bug.cgi?id=2510863
https://github.com/advisories/GHSA-5c9w-jj2v-89qh