What is CVE-2026-92778?

CVE-2026-92778 is a medium-severity vulnerability in Yahoo Cmak, classified under Protection Mechanism Failure. CVSS score: 5.4/10. Published 2026-09-16.

How severe is CVE-2026-92778?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Vulnerability in Yahoo Cmak

CVE-2026-92778

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.

Affected products

Yahoo Cmak

Weakness classification (CWE)

CWE-693 — Protection Mechanism Failure

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-92778?: CVE-2026-92778 is a medium-severity vulnerability in Yahoo Cmak, classified under Protection Mechanism Failure. CVSS score: 5.4/10. Published 2026-09-16.
How severe is CVE-2026-92778?: Medium severity. CVSS v3 base score is 5.4 out of 10.