CVE-2026-27134 Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted...

CVE-2026-27134

Summary of CVE-2026-27134 (Strimzi) : A flaw in Strimzi 0.49.0–0.50.0 causes misconfiguration of trusted certificates for mTLS when using a custom Cluster/Clients CA with a multistage CA chain. Consequently, all CAs in the chain are trusted and users with certificates signed by any CA in the chai...

CVE-2026-27134 Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted...

CVE-2026-27133 Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA Certificate Authority certificates is used in the trusted certificates configuration of a Kafka Connect opera...

Improper Following of a Certificate's Chain of Trust

Overview Affected versions of this package are vulnerable to Improper Following of a Certificate's Chain of Trust in the Kafka Connect and MirrorMaker 2 operands with multiple CA certificates. An attacker can gain unauthorized access by presenting a server certificate signed by any CA in the chai...

CVE-2026-27133 Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA Certificate Authority certificates is used in the trusted certificates configuration of a Kafka Connect opera...

CVE-2026-27133

Summary: Strimzi Kafka Connect and Kafka MirrorMaker 2 operands on Kubernetes/OpenShift trust every CA in a multi-CA chain when configured as trusted certificates (versions 0.47.0–0.50.0). This allows certificates signed by any CA in the chain to be accepted when connecting to brokers, potentiall...

CVE-2026-27133

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA Certificate Authority certificates is used in the trusted certificates configuration of a Kafka Connect opera...

CVE-2026-27133 Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA Certificate Authority certificates is used in the trusted certificates configuration of a Kafka Connect opera...

Strimzi 安全漏洞

Strimzi is an open-source program developed by Strimzi that allows for the operation of Apache Kafka clusters on Kubernetes with various deployment configurations. Versions of Strimzi from 0.47.0 to 0.50.1 contained security vulnerabilities. These vulnerabilities stemmed from reliance on all...

CVE-2026-27133: Improper Certificate Validation

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA Certificate Authority certificates is used in the trusted certificates configuration of a Kafka Connect opera...

PT-2026-20654

Name of the Vulnerable Software and Affected Versions Strimzi versions 0.47.0 through 0.50.1 Description Strimzi allows running an Apache Kafka cluster on Kubernetes or OpenShift. When multiple Certificate Authority CA certificates are used in the trusted certificates configuration of a Kafka...

PT-2026-20655

Name of the Vulnerable Software and Affected Versions Strimzi versions 0.49.0 through 0.50.0 Description Strimzi allows running an Apache Kafka cluster on Kubernetes or OpenShift. Versions 0.49.0 through 0.50.0 incorrectly configure trusted certificates for mTLS authentication when using a custom...

Improper Permission Assignment

Strimzi is vulnerable to Improper Permission Assignment. The vulnerability is due to Strimzi creating an incorrect Kubernetes Role that grants Kafka Connect and MirrorMaker 2 operands GET access to all Secrets in the namespace, allowing these components to read sensitive data they should not have...

CVE-2025-66623

A flaw was found in Strimzi. This vulnerability allows unauthorized GET access to all Kubernetes K8s Secrets that exist in the given Kubernetes K8s namespace via incorrect Kubernetes K8s Role creation. Mitigation Mitigation for this issue is either not available or the currently available options...

GHSA-XRHH-HX36-485Q Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

Impact In some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The exact scenario when this happens is when: Apache Kafka...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the process that creates Kubernetes Role bindings. An attacker can access sensitive information by executing GET requests in affected Pods using their Service Account to retrieve any Secret from the same...

Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

Impact In some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The exact scenario when this happens is when: Apache Kafka...

CVE-2025-66623

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands th...

CVE-2025-66623 Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands th...