Junglewise Threat Intelligence

CVE-2026-27134: Strimzi Kafka Operator improper authentication in mTLS CA chain validation

CVE-2026-27134 · Severity: high · CVSS 8.1 · Published 2026-02-21

Executive brief

Strimzi, a tool for managing Apache Kafka on Kubernetes, contains a security flaw in how it handles identity verification. When configured with specific custom security certificates, the system may mistakenly trust any certificate in a chain, potentially allowing unauthorized users to connect to the data stream. This could lead to unauthorized access to sensitive business data or disruption of message services.

Technical details

A vulnerability exists in Strimzi versions 0.49.0 through 0.50.0 where the operator incorrectly configures the trusted certificates for mutual TLS (mTLS) authentication. When a custom Cluster or Clients Certificate Authority (CA) is provided as a multistage chain, Strimzi trusts all CAs in that chain rather than just the intended leaf or intermediate CA. This allows any user possessing a certificate signed by any CA in the provided chain to successfully authenticate to internal or user-configured listeners. The issue specifically affects deployments using custom CA chains and does not impact those using Strimzi-managed CAs or single-CA configurations. The vulnerability has been patched in version 0.50.1.

Affected products

  • Strimzi strimzi-kafka-operator 0.49.0 - 0.50.0
  • Red Hat streams for Apache Kafka 2 2
  • Red Hat streams for Apache Kafka 3 3

Timeline

  • 2026-02-19: patched: Version 0.50.1 released
  • 2026-02-19: advisory: GitHub Security Advisory GHSA-2qwx-rq6j-8r6j published
  • 2026-02-21: disclosed: CVE-2026-27134 published to NVD

References

Related threats