CVE-2026-92778: CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs low-privileged access to CMAK. The vulnerability is reachable over the network and does not require user interaction.
Which functionality can be misused through the bypass?
An attacker can access HTML form endpoints that start or stop the recurring leader election scheduler, despite the scheduled leader election feature toggle. This can disrupt leadership across Kafka clusters managed by CMAK.
Are deployments with the scheduled leader election feature disabled still exposed?
Yes. The issue is specifically a failure to enforce the scheduled leader election feature toggle on HTML form routes, allowing those routes to bypass the gate.