Console vulnerabilities
CVEs whose affected-version data names the Console package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-120869Critical· 9.3An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
CVE-2026-105312Critical· 9.9Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBindin…
CVE-2026-105311High· 7.7Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with …
CVE-2026-110210Medium· 5.3PoCPhase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query
Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key…
CVE-2026-96740Medium· 6.5A flaw was found in the StreamsHub Console for Apache Kafka
A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, al…