CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0.
- Record
CVE-2026-55226- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-269, CWE-272
- Updated
- 2026-11-02
EUVDEUVD-2026-78880
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0.
- Record
EUVD-2026-78880- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r427-j2h7-wv3m
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
Impact
When only the Topic or only the User operators are deployed as part of the Entity Operator in the Kafka custom resource, the RBAC rights are not following the principle of least-privilege and the Entity Operator ServiceAccount still has access rights corresponding to both operators. That might allow the ServiceAccount to access KafkaUser custom resources and Secrets when the User operator is not deployed and access KafkaTopic custom resources when the Topic operator is not deployed.
Patches
The issue is fixed in Strimzi 1.0.1 and 1.1.0.
Workarounds
There is no workaround for this issue.
- Record
GHSA-r427-j2h7-wv3m- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-269, CWE-272
- Updated
- 2026-11-02
NVD
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0.
- Record
CVE-2026-55226- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-269, CWE-272
- Updated
- 2026-11-02
OSV
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0.
- Record
CVE-2026-55226- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-269, CWE-272
- Updated
- 2026-11-02
OSVGHSA-r427-j2h7-wv3m
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
Impact
When only the Topic or only the User operators are deployed as part of the Entity Operator in the Kafka custom resource, the RBAC rights are not following the principle of least-privilege and the Entity Operator ServiceAccount still has access rights corresponding to both operators. That might allow the ServiceAccount to access KafkaUser custom resources and Secrets when the User operator is not deployed and access KafkaTopic custom resources when the Topic operator is not deployed.
Patches
The issue is fixed in Strimzi 1.0.1 and 1.1.0.
Workarounds
There is no workaround for this issue.
- Record
GHSA-r427-j2h7-wv3m- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-269, CWE-272
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.strimzi:strimziMaven |
through 1.0.0 | 1.0.1 |
io.strimzi:strimziMaven |
before 1.0.1, plus listed versions 0.10.00.11.00.11.10.11.20.11.3 Show 45 moreShow less0.11.40.12.00.12.10.12.20.13.00.14.00.15.00.16.00.16.10.16.20.17.00.18.00.19.00.20.00.20.10.21.00.21.10.22.00.22.10.23.00.24.00.25.00.26.00.26.10.27.00.27.10.28.00.29.00.30.00.31.00.31.10.32.00.33.00.33.10.33.20.34.00.35.00.35.10.36.00.36.10.37.00.38.00.39.00.40.00.41.0 |
1.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-55226 is a medium vulnerability (CVSS 5.4) in Strimzi Strimzi-kafka-operator, published June 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in io.strimzi:strimzi 1.0.1.
References
github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-r427-j2h7-wv3m
Left out here: 31 versions. The JSON record has them.