Source: Internal security audit — Streams for Apache Kafka Console f002
Upstream project: StreamsHub Console (Red Hat-owned, github.com/streamshub/console)
Upstream advisory: N/A — Red Hat-owned code, no external disclosure needed

Affected code:
- ConfigurationProcessor.java — setKafkaUserConfig() accepts tenant-controlled namespace without validation
- CredentialsKafkaUser.java — namespace field is plain String with no validation
- ConsoleSecret.java — writes exfiltrated credentials to attacker's namespace
- ClusterRole grants unrestricted cluster-wide Secrets CRUD

Fix status: Unfixed in upstream main (bfc823f) and all downstream versions. Requires assertNamespaceAllowed() guard with same-namespace default.