CVE-2026-27133

Summary: Strimzi Kafka Connect and Kafka MirrorMaker 2 operands on Kubernetes/OpenShift trust every CA in a multi-CA chain when configured as trusted certificates (versions 0.47.0–0.50.0). This allows certificates signed by any CA in the chain to be accepted when connecting to brokers, potentiall...

CVE-2025-66623

Strimzi (Kafka on Kubernetes/OpenShift) has a vulnerability in versions 0.47.0–0.49.0 where an incorrect Kubernetes Role allows GET access to all Secrets in the target namespace for Kafka Connect and MirrorMaker 2 operands. The issue is fixed in Strimzi 0.49.1. Impact is restricted to unauthorize...