# CVE-2026-55226: Strimzi Kafka Operator least privilege violation in Entity Operator

Source: https://junglewise.ai/threats/cve-2026-55226-strimzi-kafka-operator-least-privilege-violation-in-entity  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

CVE-2026-55226 · Severity: medium · CVSS 5.4 · Published 2026-09-15

Strimzi is a tool used to run and manage Apache Kafka on Kubernetes. A security flaw in its configuration means that certain internal components are granted more access than they need to function. This could allow an attacker who has already gained a foothold in the network to access sensitive information, such as security credentials or configuration details, that they should not be able to see.

Technologies: [io.strimzi:strimzi (Maven)](https://junglewise.ai/threats/technologies/io-strimzi-strimzi), [Strimzi Kafka Operator](https://junglewise.ai/threats/technologies/kafka-operator). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Strimzi](https://junglewise.ai/threats/vendors/strimzi).

## Quick answers

**Is CVE-2026-55226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55226 being exploited in the wild.

**How severe is CVE-2026-55226?** Medium severity, with a CVSS score of 5.4, published 15 September 2026.

**Which products and versions are affected?** io.strimzi:strimzi (Maven) <= 1.0.0, ECOSYSTEM:introduced=0,fixed=1.0.1; Strimzi Kafka Operator <= 1.0.0.

**Is there a fix for CVE-2026-55226?** Yes. io.strimzi:strimzi (Maven): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55226 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-55226?** Check whether you run io.strimzi:strimzi (Maven) or Strimzi Kafka Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.strimzi:strimzi (Maven): upgrade to 1.0.1 or later

  ```sh
  # set io.strimzi:strimzi to 1.0.1 in your pom.xml or build.gradle
  ```


## Technical details

Strimzi Kafka Operator suffers from improper privilege management (CWE-269) within its Entity Operator component. When a user deploys only the Topic Operator or only the User Operator, the shared ServiceAccount is incorrectly granted RBAC permissions for both components. This allows the Topic Operator to access KafkaUser resources and Secrets, or the User Operator to access KafkaTopic resources, even when those features are not intended to be active. An attacker with low privileges on an adjacent network could exploit this over-provisioning to access sensitive Kubernetes Secrets or manipulate Kafka resources. The issue is resolved in versions 1.0.1 and 1.1.0 by ensuring RBAC rights are scoped to the specific operators deployed.

## Affected products

- Strimzi strimzi-kafka-operator <= 1.0.0

## Identifiers

- CVE-2026-55226
- GHSA-r427-j2h7-wv3m

## Timeline

- 2026-06-17: disclosed
- 2026-06-18: advisory

## References

- [https://api.github.com/users/katheris](https://api.github.com/users/katheris)
- [https://github.com/katheris](https://github.com/katheris)
- [https://api.github.com/users/katheris/gists%7B/gist_id%7D](https://api.github.com/users/katheris/gists%7B/gist_id%7D)
- [https://api.github.com/users/katheris/repos](https://api.github.com/users/katheris/repos)
- [https://avatars.githubusercontent.com/u/11195226?v=4](https://avatars.githubusercontent.com/u/11195226?v=4)
- [https://api.github.com/users/katheris/events%7B/privacy%7D](https://api.github.com/users/katheris/events%7B/privacy%7D)

## Related threats

- [Strimzi Kafka Operator privilege escalation in Kafka.spec.entityOperator](https://junglewise.ai/threats/cve-2026-55225-strimzi-kafka-operator-privilege-escalation-in-kafka-spec)
- [Strimzi Kafka Operator improper authentication in mTLS CA chain validation](https://junglewise.ai/threats/cve-2026-27134-strimzi-kafka-operator-improper-authentication-in-mtls-ca-chain)
- [Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands](https://junglewise.ai/threats/cve-2025-66623-strimzi-provides-a-way-to-run-an-apache-kafka-cluster-on)
- [STRIMZI incorrect access control](https://junglewise.ai/threats/cve-2024-36543-strimzi-incorrect-access-control)