CVE-2026-92751

CMAK (Cluster Manager for Apache Kafka, formerly Yahoo Kafka Manager) through version 3.0.0.6 does not install a cross-site request forgery (CSRF) filter, leaving its state-changing endpoints unprotected. An attacker can lure an authenticated CMAK operator to a page containing hidden forms that auto-submit to destructive endpoints such as topic deletion and cluster configuration changes. The requests are authenticated using the operator's HTTP Basic credentials or the play-basic-authentication cookie, which lacks SameSite protection and therefore is sent along with the forged cross-origin request. Any organization running CMAK 3.0.0.6 or earlier is affected, with operators' browser sessions as the attack vector. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known.

What to do: No fixed release is identified in the available data, so monitor the CMAK project for a patched version beyond 3.0.0.6 and upgrade when one is published. In the interim, restrict CMAK access to trusted networks or a VPN, place it behind a reverse proxy that enforces Origin/Referer validation on state-changing requests, and add SameSite=Lax or Strict attributes to the play-basic-authentication cookie. Audit recent topic deletions and cluster configuration changes for signs of forged requests.