Executive brief
CMAK is a web-based tool for managing Apache Kafka clusters used by data and operations teams. The application fails to implement CSRF protection, allowing an attacker to trick an authenticated operator into performing destructive actions like deleting topics or modifying cluster configurations. An attacker can craft a malicious webpage that, when visited by a logged-in operator, silently executes harmful operations using the operator's existing session.
Technical details
CMAK through version 3.0.0.6 lacks a CSRF (cross-site request forgery) filter in its request handling pipeline. The vulnerability exists in the KafkaManagerLoader.scala file where the httpFilters configuration only registers BasicAuthenticationFilter, omitting CSRF protection middleware. Attackers can craft hidden HTML forms targeting state-changing endpoints (e.g., topic deletion, cluster configuration changes) and trick authenticated operators into submitting them via their browser. The attack is enabled by the lack of SameSite cookie protection on the play-basic-authentication cookie and HTTP Basic authentication headers automatically included in cross-origin requests. An attacker can cause permanent data loss or cluster misconfiguration without the operator's knowledge or consent. Patches are available in versions after 3.0.0.6.
Affected products
- Yahoo CMAK through 3.0.0.6
Timeline
- 2026-09-16: disclosed