CVE-2026-55226— Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
Quick assessment
Affected
strimzi strimzi-kafka-operator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： 原文： Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resourc
Possible ATT&CK Techniques 2 AI
T1078.004 · Cloud Accounts T1548.005 · Temporary Elevated Cloud Access
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55226
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
Source: CVE Program / CVE List V5
Vulnerability Description
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| strimzi | strimzi-kafka-operator | < 1.0.1 | - |
|
II. Public POCs for CVE-2026-55226
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55226
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55226 (1)
Vendor Advisories for CVE-2026-55226 (1)
Vendor Pages for CVE-2026-55226 (2)
-
🔗 Release 1.0.1 · strimzi/strimzi-kafka-operator · GitHub x_refsource_MISC
-
IV. Related Vulnerabilities
Same product: strimzi-kafka-operator
-
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spe -
CVE-2026-27134
Strimzi: All CAs from a custom CA chain consisting of multip -
CVE-2026-27133
Strimzi All CAs from CA chain will be trusted in Kafka Conne -
CVE-2025-66623
Strimzi allows unrestricted access to all Secrets in the sam
Same vendor: strimzi
-
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spe -
CVE-2026-27134
Strimzi: All CAs from a custom CA chain consisting of multip -
CVE-2026-27133
Strimzi All CAs from CA chain will be trusted in Kafka Conne -
CVE-2025-66623
Strimzi allows unrestricted access to all Secrets in the sam
Same weakness: CWE-269
-
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spe -
CVE-2026-65831
ArcadeDB: Privilege escalation via reader role in /api/v1/co -
CVE-2026-61549
Woodpecker: Privilege escalation via unrestricted serviceAcc -
CVE-2026-54168
Pipelines-as-Code: Unscoped GitHub App installation token al -
CVE-2026-14805
Consulting - Business, Finance WordPress Theme <= 6.7.16 - A
V. Comments for CVE-2026-55226
No comments yet