High severity · published Dec 5, 2025
CVE-2025-66623
Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands
7.4
CVSS
0.2%
EPSS
No
On KEV
Description
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The issue is fixed in Strimzi 0.49.1.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
strimzi-kafka-operator · strimzi
>= 0.47.0, < 0.49.1 · source: vendor
ST
Strimzi · Linuxfoundation
before 0.49.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66623
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66623
Patch
https://github.com/strimzi/strimzi-kafka-operator/commit/c8a14935e99c91eb0dd865431f46515da9f82ccc
Vendor Advisory
https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-xrhh-hx36-485q
More from strimzi-kafka-operator
8.1
CVE-2026-27134
Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication
8.0
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`
5.9
CVE-2026-27133
Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters
5.4
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator