# CVE-2026-27134: Strimzi Kafka Operator improper authentication in mTLS CA chain validation

Source: https://junglewise.ai/threats/cve-2026-27134-strimzi-kafka-operator-improper-authentication-in-mtls-ca-chain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-21. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-27134 · Severity: high · CVSS 8.1 · Published 2026-02-21

Strimzi, a tool for managing Apache Kafka on Kubernetes, contains a security flaw in how it handles identity verification. When configured with specific custom security certificates, the system may mistakenly trust any certificate in a chain, potentially allowing unauthorized users to connect to the data stream. This could lead to unauthorized access to sensitive business data or disruption of message services.

Technologies: [Red Hat Streams for Apache Kafka 2](https://junglewise.ai/threats/technologies/streams-for-apache-kafka), [Strimzi Kafka Operator](https://junglewise.ai/threats/technologies/kafka-operator). Vendors: [Linuxfoundation](https://junglewise.ai/threats/vendors/linuxfoundation), [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [Strimzi](https://junglewise.ai/threats/vendors/strimzi).

## Quick answers

**Is CVE-2026-27134 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27134 being exploited in the wild.

**How severe is CVE-2026-27134?** High severity, with a CVSS score of 8.1, published 21 February 2026.

**Which products and versions are affected?** Red Hat Streams for Apache Kafka 2 2; Red Hat Streams for Apache Kafka 3 3; Strimzi Kafka Operator 0.49.0 - 0.50.0.

**Is there a fix for CVE-2026-27134?** A patch was published on 2026-02-19: Version 0.50.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27134 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27134?** Check whether you run Linuxfoundation Strimzi Kafka Operator, Red Hat Streams for Apache Kafka 2, Red Hat Streams for Apache Kafka 3 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Strimzi versions 0.49.0 through 0.50.0 where the operator incorrectly configures the trusted certificates for mutual TLS (mTLS) authentication. When a custom Cluster or Clients Certificate Authority (CA) is provided as a multistage chain, Strimzi trusts all CAs in that chain rather than just the intended leaf or intermediate CA. This allows any user possessing a certificate signed by any CA in the provided chain to successfully authenticate to internal or user-configured listeners. The issue specifically affects deployments using custom CA chains and does not impact those using Strimzi-managed CAs or single-CA configurations. The vulnerability has been patched in version 0.50.1.

## Affected products

- Strimzi strimzi-kafka-operator 0.49.0 - 0.50.0
- Red Hat streams for Apache Kafka 2 2
- Red Hat streams for Apache Kafka 3 3

## Timeline

- 2026-02-19: patched: Version 0.50.1 released
- 2026-02-19: advisory: GitHub Security Advisory GHSA-2qwx-rq6j-8r6j published
- 2026-02-21: disclosed: CVE-2026-27134 published to NVD

## References

- [https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1](https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1)
- [https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-2qwx-rq6j-8r6j](https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-2qwx-rq6j-8r6j)
- [https://access.redhat.com/security/cve/CVE-2026-27134](https://access.redhat.com/security/cve/CVE-2026-27134)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2441564](https://bugzilla.redhat.com/show_bug.cgi?id=2441564)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27134.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27134.json)

## Related threats

- [Strimzi Kafka Operator least privilege violation in Entity Operator](https://junglewise.ai/threats/cve-2026-55226-strimzi-kafka-operator-least-privilege-violation-in-entity)
- [Strimzi Kafka Operator privilege escalation in Kafka.spec.entityOperator](https://junglewise.ai/threats/cve-2026-55225-strimzi-kafka-operator-privilege-escalation-in-kafka-spec)