GitHub Advisoryadvisory · Maven

GHSA-r427-j2h7-wv3m Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

MEDIUM Published 2026-06-18 Modified 2026-06-18 Official page ↗
Aliases
CVE-2026-55226
Ecosystem
Maven
Packages
io.strimzi:strimzi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-269, CWE-272
Reviewed
2026-06-18

Affected packages

• Maven io.strimzi:strimzi: < 1.0.1 → fixed in 1.0.1

Description

Impact When only the Topic or only the User operators are deployed as part of the Entity Operator in the `Kafka` custom resource, the RBAC rights are not following the principle of least-privilege and the Entity Operator ServiceAccount still has access rights corresponding to both operators. That might allow the ServiceAccount to access `KafkaUser` custom resources and Secrets when the User operator is not deployed and access `KafkaTopic` custom resources when the Topic operator is not deployed. Patches The issue is fixed in Strimzi 1.0.1 and 1.1.0. Workarounds There is no workaround for this issue.

Related

Alias · CVE (1)

  • CVE-2026-55226 Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-272 Least Privilege Violation weakness

References