Medium severity · published Feb 20, 2026
CVE-2026-27133
Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA (Certificate Authority) certificates is used in the trusted certificates configuration of a Kafka Connect operand or of the target cluster in the Kafka MirrorMaker 2 operand, all of the certificates that are part of the CA chain will be trusted individually when connecting to the Apache Kafka cluster. Due to this error, the affected operand (Kafka Connect or Kafka MirrorMaker 2) might accept connections to Kafka brokers using server certificates signed by one of the other CAs in the CA chain and not just by the last CA in the chain. This issue is fixed in Strimzi 0.50.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
strimzi-kafka-operator · strimzi
>= 0.47.0, < 0.51.1 · source: vendor
ST
Strimzi · Linuxfoundation
0.47.0 before 0.50.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27133
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27133
Product
https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1
Vendor Advisory
https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-6x85-j2f7-4xc5
More from strimzi-kafka-operator
8.1
CVE-2026-27134
Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication
8.0
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`
5.4
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator