CVE-2026-92751 in CMAK
Summary
by MITRE • 09/16/2026
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or play-basic-authentication cookie without SameSite protection.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in CMAK versions up to 3.0.0.6 represents a critical failure in implementing anti-CSRF protections for administrative interfaces. Cross-site request forgery, commonly known as CSRF, is an attack that forces an end user to execute unwanted actions on a trusted web application in which they are currently authenticated. In this specific instance, the software fails to install or enforce a cross-site request forgery filter, leaving state-changing endpoints exposed to malicious manipulation by attackers who can trick users into submitting requests without their knowledge or consent.
The technical flaw lies in the absence of mechanisms such as synchronizer tokens or strict SameSite cookie attributes for sensitive operations. When an operator is authenticated via HTTP Basic authentication credentials or a play-basic-authentication cookie, these session identifiers are automatically included in any request sent to the CMAK server from that browser context. Because there is no additional verification step unique to each user session, such as a CSRF token embedded in forms and validated on submission, the application cannot distinguish between legitimate requests initiated by the operator and maliciously crafted requests submitted via hidden HTML forms hosted on an attacker-controlled domain.
The operational impact of this vulnerability is severe due to the high privilege level typically associated with CMAK operators. Attackers can craft deceptive web pages containing hidden forms that automatically submit to destructive endpoints within the application. These endpoints include critical functions such as topic deletion and cluster configuration changes. If a victim operator visits the malicious page while logged into their CMAK session, the browser will send the necessary authentication cookies along with the forged request. This results in unauthorized modifications to Kafka topics or cluster settings, potentially leading to data loss, service disruption, or misconfiguration that compromises the stability of the entire distributed streaming platform managed by CMAK.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery as a weakness where an application does not sufficiently verify whether a request was intentionally initiated by the user. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK techniques, this falls under T1078 Valid Accounts and specifically relates to methods used for persistence or impact through unauthorized configuration changes. The lack of SameSite protection on authentication cookies exacerbates the risk, as it allows these credentials to be sent in cross-site requests by default across modern browsers that do not strictly enforce strict same-origin policies for all cookie types without explicit flags.
Mitigation strategies must focus on implementing robust anti-CSRF measures immediately. Developers should integrate synchronizer tokens into all state-changing forms and API endpoints, ensuring that each request includes a unique, unpredictable token tied to the user's session which is validated server-side before processing any action. Additionally, setting the SameSite attribute to Strict or Lax for authentication cookies prevents them from being sent in cross-site requests entirely, providing an effective defense layer against CSRF attacks regardless of other application logic. Upgrading to a patched version that includes these security filters is essential for restoring trust and integrity within the administrative interface.