CVE-2026-55226

When deploying only the Topic Operator or only the User Operator via the Kafka custom resource, the Entity Operator's ServiceAccount retains RBAC rights for both operators rather than scoping permissions to the one actually deployed. This allows the ServiceAccount to access KafkaUser custom...

PT-2026-50540

Name of the Vulnerable Software and Affected Versions Strimzi versions prior to 1.0.1 Description When the cluster operator is deployed with watchAnyNamespace=true or a multi-namespace list, a namespace editor can manipulate the Kafka.spec.entityOperator.userOperator.watchedNamespace or...