CVE-2026-55226mediumCWE-269CWE-272

CVE-2026-55226: fallo de gravedad media en strimzi-kafka-operator

Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear strimzi-kafka-operator+ Monitorear io.strimzi:strimzi

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.3%
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0.
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Productos afectados
strimzi · strimzi-kafka-operator
CVEs relacionadas — strimzi-kafka-operator

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-27134HIGHStrimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autenticationEPSS 0.4%CVE-2026-55225HIGHStrimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`EPSS 0.3%CVE-2026-27133MEDIUMStrimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clustersEPSS 0.2%CVE-2025-66623HIGHStrimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operandsEPSS 0.2%