GHSA-HPCC-26XQ-25FV vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, strimzi-kafka-operator-fips, opensearch, camunda-zeebe, camunda, opensearch-fips, apache-hop, apache-hop-fips...

CVE-2026-56816 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, strimzi-kafka-operator-fips, opensearch, camunda-zeebe, camunda, opensearch-fips, apache-hop, apache-hop-fips...

GHSA-HPCC-26XQ-25FV vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, opensearch...

CVE-2026-56816 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, opensearch...

CVE-2026-55226

When deploying only the Topic Operator or only the User Operator via the Kafka custom resource, the Entity Operator's ServiceAccount retains RBAC rights for both operators rather than scoping permissions to the one actually deployed. This allows the ServiceAccount to access KafkaUser custom...

GHSA-R427-J2H7-WV3M Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

Impact When only the Topic or only the User operators are deployed as part of the Entity Operator in the Kafka custom resource, the RBAC rights are not following the principle of least-privilege and the Entity Operator ServiceAccount still has access rights corresponding to both operators. That...

GHSA-MW9R-P8XP-WX96 Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

Impact Having the Topic and User operators to watch different namespaces than the one where the Kafka cluster is deployed, is a fully documented feature. When the watchedNamespace field is used within the Topic or User operator as part of the Kafka.spec.entityOperator field, the Cluster Operator...

CVE-2026-55225

When the Strimzi cluster operator is deployed with watchAnyNamespace=true or a multi-namespace list, any namespace editor can set Kafka.spec.entityOperator.userOperator.watchedNamespace or topicOperator.watchedNamespace to an arbitrary namespace. The cluster operator then creates a Role granting...

PT-2026-50540

Impact Having the Topic and User operators to watch different namespaces than the one where the Kafka cluster is deployed, is a fully documented feature. When the watchedNamespace field is used within the Topic or User operator as part of the Kafka.spec.entityOperator field, the Cluster Operator...

PT-2026-50541

Impact When only the Topic or only the User operators are deployed as part of the Entity Operator in the Kafka custom resource, the RBAC rights are not following the principle of least-privilege and the Entity Operator ServiceAccount still has access rights corresponding to both operators. That...

CLEANSTART-2026-RG24361 Security fixes for CVE-2025-11143, CVE-2026-1605, ghsa-72hv-8253-57qq, ghsa-cphf-4846-3xx9 applied in versions: 0.50.0-r0, 0.51.0-r0

Multiple security vulnerabilities affect the strimzi-kafka-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GQ14179 Security fixes for CVE-2025-11143, CVE-2025-53864, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057, CVE-2025-67735, CVE-2025-68161, CVE-2026-1002, CVE-2026-1605, ghsa-72hv-8253-57qq applied in versions: 0.46.1-r3, 0.46.1-r4

Multiple security vulnerabilities affect the strimzi-kafka-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IA43044 Security fixes for CVE-2020-8908, CVE-2022-42889, CVE-2023-2976, CVE-2024-25710, CVE-2024-26308, CVE-2024-29371, CVE-2024-29857, CVE-2024-30171, CVE-2024-31573, CVE-2024-47554, CVE-2025-11143, CVE-2025-12383, CVE-2025-48734, CVE-2025-48924, CVE-2025-58057, CVE-2025-67735, CVE-2025-68161, CVE-2025-8916, CVE-2026-1002, CVE-2026-1605, ghsa-72hv-8253-57qq applied in versions: 0.47.0-r2, 0.47.0-r3

Multiple security vulnerabilities affect the strimzi-kafka-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DC73689 Security fixes for CVE-2025-11143, CVE-2025-67735, CVE-2025-68161, CVE-2026-1002, CVE-2026-1605, ghsa-72hv-8253-57qq applied in versions: 0.48.0-r1

Multiple security vulnerabilities affect the strimzi-kafka-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GM79879 Security fixes for CVE-2025-11143, CVE-2025-68161, CVE-2026-1002, CVE-2026-1605, ghsa-72hv-8253-57qq applied in versions: 0.49.1-r0

Multiple security vulnerabilities affect the strimzi-kafka-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DS86833 Security fixes for CVE-2025-11143, CVE-2026-1605, ghsa-72hv-8253-57qq, ghsa-cphf-4846-3xx9 applied in versions: 0.50.0-r0, 0.50.1-r0

Multiple security vulnerabilities affect the strimzi-kafka-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-1605 vulnerabilities

Vulnerabilities for packages: druid, solr, confluent-kafka, kafka, dependency-track, trino, strimzi-kafka-operator, akhq, apache-pulsar...

GHSA-XXH7-FCF3-RJ7F vulnerabilities

Vulnerabilities for packages: druid, solr, confluent-kafka, kafka, dependency-track, trino, strimzi-kafka-operator, akhq, apache-pulsar...

GHSA-XXH7-FCF3-RJ7F vulnerabilities

Vulnerabilities for packages: confluent-kafka, neo4j, strimzi-kafka-operator, druid, akhq, trino, apache-pulsar, apache-hop, dependency-track, kafka, solr, apache-jena-fuseki, jenkins, kafka-fips, dependency-track-apiserver, apache-pulsar-fips, confluent-kafka-jre-bcfips, apache-hop-fips...

CVE-2026-1605 vulnerabilities

Vulnerabilities for packages: confluent-kafka, neo4j, strimzi-kafka-operator, druid, akhq, trino, apache-pulsar, apache-hop, dependency-track, kafka, solr, apache-jena-fuseki, jenkins, kafka-fips, dependency-track-apiserver, apache-pulsar-fips, confluent-kafka-jre-bcfips, apache-hop-fips...