Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 9
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-23 10:31
- References+1 references (now 3)NVD modified 2026-10-23 12:18
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-23 12:18
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-22 21:21
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-22 22:17
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-20 11:30
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-20 15:03
- StatusReceived → PublishedNVD modified 2026-10-20 11:30
- First seenCVSS 8.8NVD modified 2026-10-20 12:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.