GCVE-110-CONFSA-2026-0085

Impacted versions: Confluent Platform Recommended action: Confluent Platform customers running ksqlDB with RBAC (the commercial KsqlSecurityExtension / RBAC plugin) enabled should upgrade to the latest patched release versions. Confluent Cloud and open-source ksqlDB customers do not need to take any action. Issue: On self-managed Confluent Platform deployments with ksqlDB RBAC enabled, the /query-stream pull-query endpoint does not perform the per-user authorization check that the legacy /query endpoint performs for an equivalent query. As a result, an authenticated ksqlDB user without an RBAC read grant on a given table can issue a pull query against that table through /query-stream and receive query results, even though the same query submitted through /query is correctly denied with an authorization error. This allows an authenticated but unauthorized user to read data from ksqlDB tables they have not been granted access to, resulting in unauthorized disclosure of materialized query results. Remediation: Confluent Platform: This issue is resolved in the following versions of Confluent Platform: 7.6.14, 7.7.12, 7.8.11, 7.9.10, 8.0.8, 8.1.6, 8.2.4, 8.3.2. CVSS Scores: Confluent Platform : 5.7 (Medium) ( https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N&version=3.1 )