# CVE-2026-92751: Yahoo CMAK cross-site request forgery in operator actions

Source: https://junglewise.ai/threats/cve-2026-92751-yahoo-cmak-cross-site-request-forgery-in-operator-actions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92751 · Severity: high · CVSS 8.1 · Published 2026-09-16

CMAK is a web-based tool for managing Apache Kafka clusters used by data and operations teams. The application fails to implement CSRF protection, allowing an attacker to trick an authenticated operator into performing destructive actions like deleting topics or modifying cluster configurations. An attacker can craft a malicious webpage that, when visited by a logged-in operator, silently executes harmful operations using the operator's existing session.

Vendors: [Yahoo](https://junglewise.ai/threats/vendors/yahoo).

## Quick answers

**Is CVE-2026-92751 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92751 being exploited in the wild.

**How severe is CVE-2026-92751?** High severity, with a CVSS score of 8.1, published 16 September 2026.

**Which products and versions are affected?** Yahoo CMAK through 3.0.0.6.

**Is there a fix for CVE-2026-92751?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92751 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92751?** Check whether you run Yahoo CMAK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CMAK through version 3.0.0.6 lacks a CSRF (cross-site request forgery) filter in its request handling pipeline. The vulnerability exists in the KafkaManagerLoader.scala file where the httpFilters configuration only registers BasicAuthenticationFilter, omitting CSRF protection middleware. Attackers can craft hidden HTML forms targeting state-changing endpoints (e.g., topic deletion, cluster configuration changes) and trick authenticated operators into submitting them via their browser. The attack is enabled by the lack of SameSite cookie protection on the play-basic-authentication cookie and HTTP Basic authentication headers automatically included in cross-origin requests. An attacker can cause permanent data loss or cluster misconfiguration without the operator's knowledge or consent. Patches are available in versions after 3.0.0.6.

## Affected products

- Yahoo CMAK through 3.0.0.6

## Timeline

- 2026-09-16: disclosed

## References

- [https://github.com/yahoo/CMAK](https://github.com/yahoo/CMAK)
- [https://github.com/yahoo/CMAK/blob/3.0.0.6/app/loader/KafkaManagerLoader.scala](https://github.com/yahoo/CMAK/blob/3.0.0.6/app/loader/KafkaManagerLoader.scala)

## Related threats

- [Yahoo CMAK feature gate bypass in HTML form routes](https://junglewise.ai/threats/cve-2026-92778-yahoo-cmak-feature-gate-bypass-in-html-form-routes)