CVE-2026-105949

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

• CWE-287

• https://access.redhat.com/security/cve/CVE-2026-105949
• https://bugzilla.redhat.com/show_bug.cgi?id=2510878

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105921A vulnerability was identified in Kusalkasilva Learning-Mana…6.3
• CVE-2026-105922A security flaw has been discovered in vllm-project vLLM up …4.3
• CVE-2026-105923A malicious SVG can trigger an integer overflow which in tur…4
• CVE-2026-10593The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unic…6.5
• CVE-2026-10594Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-105941The Azure Key Vault KMS provider in Kroxylicious accepts an …8.1
• CVE-2026-10595A path traversal vulnerability exists in parisneo/lollms ver…7.5
• CVE-2026-105950A security vulnerability has been detected in getformwork fo…3.5
• CVE-2026-105957A vulnerability was detected in SourceCodester Performance I…6.3
• CVE-2026-105958A flaw was found in spice-server. Multiple migration data ha…7.5
• CVE-2026-105959A flaw was found in spice-server. The GLZ encoder dictionary…7.5
• CVE-2026-105960PEAK-System PCAN contains a vulnerable operation involving a…5.5