CVE-2026-92778

MEDIUMCVSS 5.4

Description

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.

Timeline

Published:September 16th, 2026 9:17 PM

Last modified:September 23rd, 2026 5:17 PM

CVSS Scoring

CVSS v3: 5.4 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-693

References & Reports

Advisories, patches, and third-party reports

https://github.com/yahoo/CMAK
https://github.com/yahoo/CMAK/blob/3.0.0.6/app/controllers/PreferredReplicaElection.scala#L110-L143
https://github.com/yahoo/CMAK/issues/936
https://www.vulncheck.com/advisories/cmak-through-3.0.0.6-feature-gate-bypass-via-html-form-routes

Source: NIST NVD · Data may lag official sources by up to one minute