CVE-2026-55225

Strimzi 1.0.0 and earlier (used to run Apache Kafka clusters on Kubernetes/OpenShift) is vulnerable to cross-namespace privilege escalation via the Kafka.spec.entityOperator.watchedNamespace field. An attacker who can create a Kafka custom resource can set watchedNamespace to a target namespace, ...