CVE WatchOct 20, 2026

CVE-2026-105312

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container imag

CVSS

9.9

Critical

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 20, 2026 · Last modified: Oct 20, 2026 · CWE-269

EPSS · 30d

Not enough EPSS history yet.

Technical description

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-869333.3 LOW

—

——0A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts.3h CVE-2026-869216.2 MED

—

——0A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files.4h CVE-2026-288537.8 HIG

—

——0The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.4h CVE-2026-1054538.4 HIG

—

——0IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.4h CVE-2026-1100317.2 HIG

16.3%

——5The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.22h CVE-2026-1119204.3 MED

4.5%

——1Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.22h