CVEvulnerability

CVE-2026-27134

8.1 HIGH Published 2026-02-21 Modified 2026-07-15 Official page ↗
Status
Modified
Published
2026-02-21
Last modified
2026-07-15
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-295, CWE-296

Description

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs. It does not affect users using the Strimzi-managed Cluster and Clients CAs. It also does not affect users using custom Cluster or Clients CA with only a single CA (i.e., no CA chain with multiple CAs). This issue has been fixed in version 0.50.1. To workaround this issue, instead of providing the full CA chain as the custom CA, users can provide only the single CA that should be used.

Affected configurations

• linuxfoundation strimzi kafka operator (>= 0.49.0 < 0.50.1)

Related

Weakness · CWE (3)

  • CWE-287 Improper Authentication weakness
  • CWE-295 Improper Certificate Validation weakness
  • CWE-296 Improper Following of a Certificate's Chain of Trust weakness

References