kafka-keycloak-oauth

Apache Kafka 4.1.0 与 Keycloak OAuth2 认证 生产就绪的 Apache Kafka 4.1.0（KRaft 模式），使用 Strimzi Kafka 镜像实现 Keycloak 26.1.1 OAuth2/OIDC 认证。 为什么选择本项目 vs kafka-oauth-keycloak-tls-demo 这是之前 POC 的演进 版本，具有显著改进： Strimzi OAuth 0.17.0 （对比 1.0.0）- 随 Strimzi Kafka 0.48.0 镜像捆绑的稳定生产版本 无需自定义 Docker 构建 - 使用预装 OAuth 的官方...

CLEANSTART-2026-AH40201 Security fixes in strimzi-kafka-operator 1.2.0-r2

Package strimzi-kafka-operator version 1.2.0-r2 fixes 1 vulnerabilities: CVE-2025-12183...

CLEANSTART-2026-LI34904 Security fixes in strimzi-kafka-operator 1.2.0-r1

Package strimzi-kafka-operator version 1.2.0-r1 fixes 2 vulnerabilities: CVE-2026-59949, CVE-2026-59903...

CLEANSTART-2026-OY69138 Security fixes in strimzi-kafka-operator 1.2.0-r3

Package strimzi-kafka-operator version 1.2.0-r3 fixes 1 vulnerabilities: CVE-2025-12183...

CLEANSTART-2026-KB74242 Security fixes in strimzi-kafka-operator 1.1.0-r1

Package strimzi-kafka-operator version 1.1.0-r1 fixes 22 vulnerabilities: CVE-2026-42587, CVE-2026-47244, CVE-2026-48043, CVE-2026-50560, CVE-2026-54512...

CLEANSTART-2026-VJ08145 Security fixes in strimzi-kafka-operator 1.1.0-r2

Package strimzi-kafka-operator version 1.1.0-r2 fixes 25 vulnerabilities: CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898...

strimzi-cluster-operator: Cross-namespace privilege escalation via Kafka.spec.entityOperator.watchedNamespace in Strimzi

When the Strimzi cluster operator is deployed with watchAnyNamespace=true or a multi-namespace list, any namespace editor can set Kafka.spec.entityOperator.userOperator.watchedNamespace or topicOperator.watchedNamespace to an arbitrary namespace. The cluster operator then creates a Role granting...

CLEANSTART-2026-FP77984 Security fixes in strimzi-kafka-operator 0.46.1-r3

Package strimzi-kafka-operator version 0.46.1-r3 fixes 10 vulnerabilities: CVE-2025-11143, CVE-2025-53864, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057...

CLEANSTART-2026-WT05389 Security fixes in strimzi-kafka-operator 0.50.1-r0

Package strimzi-kafka-operator version 0.50.1-r0 fixes 3 vulnerabilities: ghsa-72hv-8253-57qq, CVE-2025-11143, CVE-2026-1605...

CLEANSTART-2026-ZE95752 Security fixes in strimzi-kafka-operator 0.50.0-r0

Package strimzi-kafka-operator version 0.50.0-r0 fixes 1 vulnerabilities: ghsa-cphf-4846-3xx9...

CLEANSTART-2026-XN43320 Security fixes in strimzi-kafka-operator 0.51.0-r1

Package strimzi-kafka-operator version 0.51.0-r1 fixes 11 vulnerabilities: CVE-2026-2332, CVE-2026-33871, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480...

CLEANSTART-2026-ZV34704 Security fixes in strimzi-kafka-operator 0.47.0-r3

Package strimzi-kafka-operator version 0.47.0-r3 fixes 1 vulnerabilities: CVE-2025-58057...

CLEANSTART-2026-BL34124 Security fixes in strimzi-kafka-operator 0.46.1-r4

Package strimzi-kafka-operator version 0.46.1-r4 fixes 1 vulnerabilities: CVE-2025-58057...

GHSA-HPCC-26XQ-25FV vulnerabilities

Vulnerabilities for packages: camunda, opensearch-fips, strimzi-kafka-operator-fips, spark-fips, camunda-zeebe, opensearch, apache-hop, apache-hop-fips, spark, strimzi-kafka-operator...

CVE-2026-56816 vulnerabilities

Vulnerabilities for packages: camunda, opensearch-fips, strimzi-kafka-operator-fips, spark-fips, camunda-zeebe, opensearch, apache-hop, apache-hop-fips, spark, strimzi-kafka-operator...

GHSA-HPCC-26XQ-25FV vulnerabilities

Vulnerabilities for packages: spark, opensearch, strimzi-kafka-operator...

CVE-2026-56816 vulnerabilities

Vulnerabilities for packages: spark, opensearch, strimzi-kafka-operator...

CVE-2026-55226

When deploying only the Topic Operator or only the User Operator via the Kafka custom resource, the Entity Operator's ServiceAccount retains RBAC rights for both operators rather than scoping permissions to the one actually deployed. This allows the ServiceAccount to access KafkaUser custom...

GHSA-R427-J2H7-WV3M Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

Impact When only the Topic or only the User operators are deployed as part of the Entity Operator in the Kafka custom resource, the RBAC rights are not following the principle of least-privilege and the Entity Operator ServiceAccount still has access rights corresponding to both operators. That...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the Kafka.spec.entityOperator process. An attacker can gain unauthorized access to read and modify secrets in other namespaces by crafting a custom resource with the watchedNamespac...