Is CVE-2026-27134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27134 being exploited in the wild.

How severe is CVE-2026-27134?

High severity, with a CVSS score of 8.1, published 21 February 2026.

Which products and versions are affected?

Red Hat Streams for Apache Kafka 2 2; Red Hat Streams for Apache Kafka 3 3; Strimzi Kafka Operator 0.49.0 - 0.50.0.

Is there a fix for CVE-2026-27134?

A patch was published on 2026-02-19: Version 0.50.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27134 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27134?

Check whether you run Linuxfoundation Strimzi Kafka Operator, Red Hat Streams for Apache Kafka 2, Red Hat Streams for Apache Kafka 3 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27134: Strimzi Kafka Operator improper authentication in mTLS CA chain validation

CVE-2026-27134 · Severity: high · CVSS 8.1 · Published 2026-02-21

Strimzi, a tool for managing Apache Kafka on Kubernetes, contains a security flaw in how it handles identity verification. When configured with specific custom security certificates, the system may mistakenly trust any certificate in a chain, potentially allowing unauthorized users to connect to the data stream. This could lead to unauthorized access to sensitive business data or disruption of message services.

Technologies: Red Hat Streams for Apache Kafka 2, Strimzi Kafka Operator. Vendors: Linuxfoundation, Red Hat, Strimzi.

Quick answers

Is CVE-2026-27134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27134 being exploited in the wild.
How severe is CVE-2026-27134?: High severity, with a CVSS score of 8.1, published 21 February 2026.
Which products and versions are affected?: Red Hat Streams for Apache Kafka 2 2; Red Hat Streams for Apache Kafka 3 3; Strimzi Kafka Operator 0.49.0 - 0.50.0.
Is there a fix for CVE-2026-27134?: A patch was published on 2026-02-19: Version 0.50.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27134 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27134?: Check whether you run Linuxfoundation Strimzi Kafka Operator, Red Hat Streams for Apache Kafka 2, Red Hat Streams for Apache Kafka 3 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Strimzi versions 0.49.0 through 0.50.0 where the operator incorrectly configures the trusted certificates for mutual TLS (mTLS) authentication. When a custom Cluster or Clients Certificate Authority (CA) is provided as a multistage chain, Strimzi trusts all CAs in that chain rather than just the intended leaf or intermediate CA. This allows any user possessing a certificate signed by any CA in the provided chain to successfully authenticate to internal or user-configured listeners. The issue specifically affects deployments using custom CA chains and does not impact those using Strimzi-managed CAs or single-CA configurations. The vulnerability has been patched in version 0.50.1.

Affected products

Strimzi strimzi-kafka-operator 0.49.0 - 0.50.0
Red Hat streams for Apache Kafka 2 2
Red Hat streams for Apache Kafka 3 3

Timeline

2026-02-19: patched: Version 0.50.1 released
2026-02-19: advisory: GitHub Security Advisory GHSA-2qwx-rq6j-8r6j published
2026-02-21: disclosed: CVE-2026-27134 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.