Medium severity5.4NVD Advisory· Published Sep 16, 2026

CVE-2026-92778

Description

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Yahoo/Cmakreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=3.0.0.6

Patches

Vulnerability mechanics

References

github.com/yahoo/CMAK/blob/3.0.0.6/app/controllers/PreferredReplicaElection.scalanvd
github.com/yahoo/CMAK/issues/936nvd
www.vulncheck.com/advisories/cmak-through-3.0.0.6-feature-gate-bypass-via-html-form-routesnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000