REDHAT-BUG-2510878: High severity LinkedIn Cruise Control vulnerability

Published Aug 4, 2026

Updated

Source: Internal security audit — Streams for Apache Kafka / Cruise Control f001 Upstream project: LinkedIn Cruise Control (github.com/linkedin/cruise-control) Upstream advisory: Pending — disclose via GitHub Security Advisory + cruise-control-oss

Affected code: - DefaultRoleSecurityProvider.java — registers exact path specs, no wildcard catch-all - KafkaCruiseControlServletApp.java — sets constraints without setDenyUncoveredHttpMethods(true) - ParameterUtils.java — Path.of(pathInfo).getFileName() strips leading segments, routes to admin endpoint

Fix status: Unfixed in upstream 2.5.146, 3.0.4, and main branch. LinkedIn-owned code.

Affected Software

1 affected component

LinkedIn Cruise Control=2.5.146, =3.0.4

Event History

Aug 4, 2026

Data Sourced

via Red Hat·03:34 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which upstream Cruise Control versions are known to remain unfixed?

The issue is reported as unfixed in upstream versions 2.5.146 and 3.0.4, as well as the main branch.

What request handling behavior creates the exposure?

Path handling in ParameterUtils uses Path.of(pathInfo).getFileName(), which strips leading path segments and can route a request to an administrative endpoint. The security configuration also lacks a wildcard catch-all path specification and does not enable denial of uncovered HTTP methods.

Is a configuration change required for the affected security handling to be present?

The affected code includes DefaultRoleSecurityProvider and KafkaCruiseControlServletApp. The available information does not identify any non-default configuration prerequisite.

What mitigation is documented if an update is not available?

No workaround or temporary mitigation is provided in the available information. The upstream versions identified as affected are reported as unfixed.

REDHAT-BUG-2510878: High severity LinkedIn Cruise Control vulnerability

Affected Software

Event History

Frequently Asked Questions

Which upstream Cruise Control versions are known to remain unfixed?

What request handling behavior creates the exposure?

Is a configuration change required for the affected security handling to be present?

What mitigation is documented if an update is not available?

Company

Resources

Contact

Frequently Asked Questions

Which upstream Cruise Control versions are known to remain unfixed?

What request handling behavior creates the exposure?

Is a configuration change required for the affected security handling to be present?

What mitigation is documented if an update is not available?