CVE-2026-92751: CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or play-basic-authentication cookie without SameSite protection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CMAKto a version that resolves this vulnerability.Fixed in 3.0.0.6Patch Cross-Site Request Forgery via Missing CSRF Filter
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated CMAK operators are exposed if they use HTTP Basic authentication or a play-basic-authentication cookie that lacks SameSite protection. An attacker can cause actions to be submitted in the operator's authenticated browser session.
What does an attacker need to exploit it?
The attacker does not need CMAK credentials, but must induce an authenticated operator to interact with attacker-controlled content, such as a page containing a hidden form. The form can submit requests to state-changing CMAK endpoints.
What actions could be performed through exploitation?
The provided information identifies destructive actions including topic deletion and cluster configuration changes. These actions are performed with the permissions of the authenticated operator whose session is used.
Which CMAK versions are known to be affected?
CMAK through version 3.0.0.6 is affected. The supplied data does not identify a fixed version.