CVE-2026-92778
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Summary
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| yahoo | CMAK | 0 <= 3.0.0.6 | affected |
Weaknesses
- CWE-693: Protection Mechanism Failure
References
- https://github.com/yahoo/CMAK/issues/936
- https://github.com/yahoo/CMAK
- https://github.com/yahoo/CMAK/blob/3.0.0.6/app/controllers/PreferredReplicaElection.scala#L110-L143
- https://www.vulncheck.com/advisories/cmak-through-3.0.0.6-feature-gate-bypass-via-html-form-routes
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.