CVE-2026-55226: Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and

Executive brief

Strimzi is a tool used to run and manage Apache Kafka on Kubernetes. A security flaw in its configuration means that certain internal components are granted more access than they need to function. This could allow an attacker who has already gained a foothold in the network to access sensitive information, such as security credentials or configuration details, that they should not be able to see.

Technical details

Strimzi Kafka Operator suffers from improper privilege management (CWE-269) within its Entity Operator component. When a user deploys only the Topic Operator or only the User Operator, the shared ServiceAccount is incorrectly granted RBAC permissions for both components. This allows the Topic Operator to access KafkaUser resources and Secrets, or the User Operator to access KafkaTopic resources, even when those features are not intended to be active. An attacker with low privileges on an adjacent network could exploit this over-provisioning to access sensitive Kubernetes Secrets or manipulate Kafka resources. The issue is resolved in versions 1.0.1 and 1.1.0 by ensuring RBAC rights are scoped to the specific operators deployed.

Affected products

• Strimzi strimzi-kafka-operator <= 1.0.0

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory

References

• https://api.github.com/users/katheris
• https://github.com/katheris
• https://api.github.com/users/katheris/gists%7B/gist_id%7D
• https://api.github.com/users/katheris/repos
• https://avatars.githubusercontent.com/u/11195226?v=4
• https://api.github.com/users/katheris/events%7B/privacy%7D