Medium severity · published Sep 15, 2026
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack vector
Adjacent
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
strimzi-kafka-operator · strimzi
< 1.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55226
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55226
github.com
https://github.com/strimzi/strimzi-kafka-operator/commit/b3bfeffcc30754c3e62e6f4afd8a76942cac440d
github.com
https://github.com/strimzi/strimzi-kafka-operator/commit/f6c5207ba7ec89b46ce6720b8638d647e556a261
github.com
https://github.com/strimzi/strimzi-kafka-operator/pull/12844
github.com
https://github.com/strimzi/strimzi-kafka-operator/releases/tag/1.0.1
github.com
https://github.com/strimzi/strimzi-kafka-operator/releases/tag/1.1.0
github.com
https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-r427-j2h7-wv3m
More from strimzi-kafka-operator
8.1
CVE-2026-27134
Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication
8.0
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`
5.9
CVE-2026-27133
Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters