CVE-2026-55225— Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`
Quick assessment
Affected
strimzi strimzi-kafka-operator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Strimzi 提供在 Kubernetes 或 OpenShift 上以多种部署配置运行 Apache Kafka 集群的方式。在 Strimzi 1.0.0 及更早版本中，能够创建 Kafka 自定义资源（Custom Resource）的攻击者可以将 Kafka 自定义资源中的 字段设置为目标命名空间。这将导致集群操作器（Cluster Operator）在该目标命名空间中创建一个具有对 Secret 进行完整 CRUD（增删改查）权限的 Role，并将其绑定到位于攻击者命名空间中的实体操作器（Entity
Possible ATT&CK Techniques 1 AI
T1548 · Abuse Elevation Control Mechanism
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55225
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`
Source: CVE Program / CVE List V5
Vulnerability Description
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. This issue is fixed in versions 1.0.1 and 1.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| strimzi | strimzi-kafka-operator | < 1.0.1 | - |
|
II. Public POCs for CVE-2026-55225
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55225
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55225 (1)
Vendor Advisories for CVE-2026-55225 (1)
Vendor Pages for CVE-2026-55225 (2)
-
🔗 Release 1.0.1 · strimzi/strimzi-kafka-operator · GitHub x_refsource_MISC
-
IV. Related Vulnerabilities
Same product: strimzi-kafka-operator
-
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace -
CVE-2026-27134
Strimzi: All CAs from a custom CA chain consisting of multip -
CVE-2026-27133
Strimzi All CAs from CA chain will be trusted in Kafka Conne -
CVE-2025-66623
Strimzi allows unrestricted access to all Secrets in the sam
Same vendor: strimzi
-
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace -
CVE-2026-27134
Strimzi: All CAs from a custom CA chain consisting of multip -
CVE-2026-27133
Strimzi All CAs from CA chain will be trusted in Kafka Conne -
CVE-2025-66623
Strimzi allows unrestricted access to all Secrets in the sam
Same weakness: CWE-269
-
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace -
CVE-2026-65831
ArcadeDB: Privilege escalation via reader role in /api/v1/co -
CVE-2026-61549
Woodpecker: Privilege escalation via unrestricted serviceAcc -
CVE-2026-54168
Pipelines-as-Code: Unscoped GitHub App installation token al -
CVE-2026-14805
Consulting - Business, Finance WordPress Theme <= 6.7.16 - A
V. Comments for CVE-2026-55225
No comments yet