io.strimzi vulnerabilities

Products

• io.strimzi/strimzi 4

Latest io.strimzi CVEs

Newest publication first

1. CVE-2026-55225 Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

   Published 2026-09-15

   High·CVSS 8.0 EPSS 0.30%

   Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causin...

2. CVE-2026-55226 Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

   Published 2026-09-15

   Medium·CVSS 5.4 EPSS 0.25%

   Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAcc...

3. CVE-2025-66623 Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

   Published 2025-12-05

   High·CVSS 7.4 EPSS 0.19%

   Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMa...

4. CVE-2024-36543 STRIMZI incorrect access control

   Published 2024-06-17

   Critical·CVSS 9.8 EPSS 0.53% PoC

   Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka ACL if it exists), a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.