Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-55225Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

High 8.0

In plain English

A high-severity privilege mismanagement in strimzi-kafka-operator from strimzi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.3%top 77.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. This issue is fixed in versions 1.0.1 and 1.1.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenio.strimzi:strimzi1.0.1GHSA-mw9r-p8xp-wx96

Affected products (as reported)

VendorProductVersions
strimzi strimzi-kafka-operator < 1.0.1

Weakness: CWE-269, CWE-441, CWE-250 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References