CVE-2026-105949 - Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
CVE ID :CVE-2026-105949 Published : Oct. 20, 2026, 11:30 a.m. | 35 minutes ago Description :Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The...