Executive brief
CMAK is a web-based tool used to manage and monitor Apache Kafka clusters. This vulnerability allows attackers to bypass a feature gate intended to restrict access to scheduled leader election controls, potentially enabling them to disrupt leadership elections across managed Kafka clusters and impacting cluster stability and availability.
Technical details
CMAK through version 3.0.0.6 fails to properly enforce the scheduled leader election feature toggle on HTML form submission routes (PreferredReplicaElection controller), despite applying the gate to API endpoints. The vulnerability exists in the `handleRunElection` method which validates the feature gate using `featureGate(KMPreferredReplicaElectionFeature)` but this protection is bypassed when attackers submit forms directly to HTML-based routes. An authenticated attacker can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership elections across managed Kafka clusters. The fix requires applying consistent feature gate validation across all routes (API and HTML-based) that provide access to the leader election functionality.
Affected products
- Yahoo CMAK through 3.0.0.6
Timeline
- 2026-09-16: disclosed