Cruise Control’s Jetty ConstraintSecurityHandler registers security constraints on exact path specs, rewarding an attacker who crafts requests with an additional path segment, such as POST /kafkacruisecontrol/x/rebalance, to bypass authentication entirely. The servlet routing logic strips all leading segments, forwarding the request to the admin endpoint, thereby exposing all 15 administrative functions without any credential verification. This constitutes an authentication bypass flaw (CWE‑287).

The vulnerability affects Red Hat AMQ Streams 2 and 3, the Cruise Control component of Apache Kafka that manages cluster operations. No specific sub‑version ranges are delineated in the CNA data, indicating the entirety of the 2.x and 3.x series is potentially impacted.

The CVSS score of 8.8 signals a high‑severity issue; the EPSS report is not available and the flaw is not listed in the CISA KEV catalog, implying a lower observed exploitation probability. Attackers require network reachability to port 9090, where Cruise Control listens. In AMQ Streams the Strimzi operator’s NetworkPolicy normally confines that port to operator pods, reducing effective risk to important. However, if the port is exposed externally, any unauthenticated user could leverage the bypass to enjoy unfettered administrative control over the cluster.