# CVE-2026-92778: Yahoo CMAK feature gate bypass in HTML form routes

Source: https://junglewise.ai/threats/cve-2026-92778-yahoo-cmak-feature-gate-bypass-in-html-form-routes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92778 · Severity: medium · CVSS 5.4 · Published 2026-09-16

CMAK is a web-based tool used to manage and monitor Apache Kafka clusters. This vulnerability allows attackers to bypass a feature gate intended to restrict access to scheduled leader election controls, potentially enabling them to disrupt leadership elections across managed Kafka clusters and impacting cluster stability and availability.

Vendors: [Yahoo](https://junglewise.ai/threats/vendors/yahoo).

## Quick answers

**Is CVE-2026-92778 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92778 being exploited in the wild.

**How severe is CVE-2026-92778?** Medium severity, with a CVSS score of 5.4, published 16 September 2026.

**Which products and versions are affected?** Yahoo CMAK through 3.0.0.6.

**Is there a fix for CVE-2026-92778?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92778 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92778?** Check whether you run Yahoo CMAK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CMAK through version 3.0.0.6 fails to properly enforce the scheduled leader election feature toggle on HTML form submission routes (PreferredReplicaElection controller), despite applying the gate to API endpoints. The vulnerability exists in the `handleRunElection` method which validates the feature gate using `featureGate(KMPreferredReplicaElectionFeature)` but this protection is bypassed when attackers submit forms directly to HTML-based routes. An authenticated attacker can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership elections across managed Kafka clusters. The fix requires applying consistent feature gate validation across all routes (API and HTML-based) that provide access to the leader election functionality.

## Affected products

- Yahoo CMAK through 3.0.0.6

## Timeline

- 2026-09-16: disclosed

## References

- [https://github.com/yahoo/CMAK](https://github.com/yahoo/CMAK)
- [https://github.com/yahoo/CMAK/blob/3.0.0.6/app/controllers/PreferredReplicaElection.scala](https://github.com/yahoo/CMAK/blob/3.0.0.6/app/controllers/PreferredReplicaElection.scala)

## Related threats

- [Yahoo CMAK cross-site request forgery in operator actions](https://junglewise.ai/threats/cve-2026-92751-yahoo-cmak-cross-site-request-forgery-in-operator-actions)