CVE-2026-92778
Last modified
CVE-2026-92778 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters..
Description
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| yahoo | CMAK | <= 3.0.0.6 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-92778?
How severe is CVE-2026-92778?
How do I fix CVE-2026-92778?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92771Twenty before 2.35.0 fails to validate field and row permiss…6.5
- CVE-2026-92772Leantime before 3.9.6 contains an authorization bypass vulne…7.1
- CVE-2026-92773Trigger.dev before 4.6.0 fails to verify that an authenticat…7.1
- CVE-2026-92774Wiki.js through 2.5.314 omits page tags from authorization c…4.3
- CVE-2026-92775Wiki.js through 2.5.314 contains a server-side request forge…6.5
- CVE-2026-92776Wiki.js through 2.5.314 fails to require path separators whe…8.1
- CVE-2026-92779Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 con…7.6
- CVE-2026-9278The Form Builder CP WordPress plugin before 1.2.47 does not …5.4
- CVE-2026-92780KnowStreaming through 3.4.1 fails to enforce role-based acce…8.8
- CVE-2026-92781Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 con…6.3
- CVE-2026-92782Chroma through 1.5.9 fails to validate tenant and database s…8.1
- CVE-2026-92783Yeti through 2.11.0 fails to validate caller permissions in …8.1
Are you affected by CVE-2026-92778?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST