The StreamsHub Console operator can act as a confused deputy, allowing a tenant who can create a Console custom resource to specify an arbitrary KafkaUser namespace. The operator, running with cluster‑wide Secrets permissions, reads the victim namespace’s KafkaUser secret—containing SASL credentials or TLS private keys—and writes that sensitive data into a new Secret within the attacker’s namespace. This flaw (CWE‑441) permits unauthorized disclosure of authentication material, potentially enabling attackers to impersonate or access Kafka clusters, thereby compromising confidentiality and integrity of the data stream.

All Red Hat StreamsHub Console for Apache Kafka and Red Hat streams for Apache Kafka versions 2 and 3 are affected. These products include the Console operator that lacks a same‑namespace validation or allowlist for the kafkaUser.namespace field.

With a CVSS score of 7.7, the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a tenant creating a Console CR with a remotely specified kafkaUser.namespace; if the tenant has permission to create Console CRs, all cluster‑wide Secrets can be read and exfiltrated. Once the attacker obtains the KafkaUser secret, they can potentially authenticate to any Kafka cluster within the tenant’s scope, giving them broad access.