Red Hat StreamsHub Console for Apache Kafka namespace-to-cluster privilege escalation via tenant-controlled container…

#!/usr/bin/env bash
# check_cve_2026_105312.sh
# Checks whether CVE-2026-105312 affects the current Kubernetes cluster.
# Looks for: (1) StreamsHub Console CRD installed, (2) vulnerable Console operator version,
# (3) tenant Roles granting create on Console CRs.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

VULN_FOUND=0
CONSOLE_CRD="consoles.console.streamshub.github.com"

echo "=== CVE-2026-105312 Check ==="
echo ""

# Step 1: Check if the Console CRD exists
if ! kubectl get crd "$CONSOLE_CRD" &>/dev/null; then
  echo "[INFO] Console CRD ($CONSOLE_CRD) not found on this cluster."
  echo "PATCHED"
  exit 1
fi
echo "[WARN] Console CRD ($CONSOLE_CRD) is installed."

# Step 2: Check console-operator deployment and image version
CONSOLE_NS=$(kubectl get deployment --all-namespaces -o json 2>/dev/null | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
for item in data.get('items', []):
    name = item.get('metadata', {}).get('name', '')
    if 'console' in name.lower() and 'operator' in name.lower():
        print(item['metadata']['namespace'])
        break
" 2>/dev/null || true)

if [ -z "$CONSOLE_NS" ]; then
  echo "[INFO] No console-operator deployment found. Checking for Console CRs directly..."
else
  echo "[INFO] Console operator found in namespace: $CONSOLE_NS"
fi

# Step 3: Check for Console CR instances
CONSOLE_COUNT=$(kubectl get consoles.console.streamshub.github.com --all-namespaces --no-headers 2>/dev/null | wc -l || echo 0)
echo "[INFO] Active Console CRs across cluster: $CONSOLE_COUNT"

# Step 4: Check if any non-admin Roles grant create on Console CRs
echo ""
echo "--- Checking for Roles granting create on Console CRs ---"
ROLE_HITS=$(kubectl get roles --all-namespaces -o json 2>/dev/null | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
hits = []
for item in data.get('items', []):
    ns = item.get('metadata', {}).get('namespace', '?')
    name = item.get('metadata', {}).get('name', '?')
    for rule in item.get('rules', []):
        resources = rule.get('resources', [])
        verbs = rule.get('verbs', [])
        api_groups = rule.get('apiGroups', [])
        if ('consoles' in resources or '*' in resources):
            if any(v in verbs for v in ['create', 'update', 'patch', '*']):
                if any(g in api_groups for g in ['console.streamshub.github.com', '*']):
                    hits.append(f'{ns}/{name}')
for h in hits:
    print(h)
" 2>/dev/null || true)

CLUSTERROLE_HITS=$(kubectl get clusterroles -o json 2>/dev/null | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
hits = []
for item in data.get('items', []):
    name = item.get('metadata', {}).get('name', '?')
    for rule in item.get('rules', []):
        resources = rule.get('resources', [])
        verbs = rule.get('verbs', [])
        api_groups = rule.get('apiGroups', [])
        if ('consoles' in resources or '*' in resources):
            if any(v in verbs for v in ['create', 'update', 'patch', '*']):
                if any(g in api_groups for g in ['console.streamshub.github.com', '*']):
                    hits.append(name)
for h in hits:
    print(h)
" 2>/dev/null || true)

if [ -n "$ROLE_HITS" ] || [ -n "$CLUSTERROLE_HITS" ]; then
  echo "[CRITICAL] Found Roles/ClusterRoles granting Console CR write access:"
  [ -n "$ROLE_HITS" ] && echo "  Roles: $ROLE_HITS"
  [ -n "$CLUSTERROLE_HITS" ] && echo "  ClusterRoles: $CLUSTERROLE_HITS"
  VULN_FOUND=1
else
  echo "[OK] No tenant-accessible Roles grant create/update/patch on Console CRs."
fi

# Step 5: Check console image versions for known vulnerable ranges
echo ""
echo "--- Checking Console pod image versions ---"
kubectl get pods --all-namespaces -o json 2>/dev/null | \
  python3 -c "
import sys, json, re
data = json.load(sys.stdin)
for item in data.get('items', []):
    ns = item.get('metadata', {}).get('namespace', '?')
    name = item.get('metadata', {}).get('name', '?')
    for c in item.get('spec', {}).get('containers', []):
        img = c.get('image', '')
        if 'console' in img.lower() and 'streamshub' in img.lower():
            print(f'  {ns}/{name}: {img}')
            # Try to extract version
            m = re.search(r':(\d+\.\d+\.\d+)', img)
            if m:
                parts = list(map(int, m.group(1).split('.')))
                v = parts[0]*10000 + parts[1]*100 + parts[2]
                if (v >= 200 and v < 1210) or (v >= 1300 and v < 1402):
                    print(f'    ^^ VULNERABLE version detected')
                else:
                    print(f'    ^^ Version appears patched')
" 2>/dev/null || echo "  [INFO] No StreamsHub Console pods found."

echo ""
if [ "$VULN_FOUND" -eq 1 ]; then
  echo "VULNERABLE"
  exit 0
else
  echo "PATCHED"
  exit 1
fi