Read the docs
TI-2026-21583 Aliases CVE-2026-27133

Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters

Priority LOW 28CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-295.

Summary

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA (Certificate Authority) certificates is used in the trusted certificates configuration of a Kafka Connect operand or of the target cluster in the Kafka MirrorMaker 2 operand, all of the certificates that are part of the CA chain will be trusted individually when connecting to the Apache Kafka cluster. Due to this error, the affected operand (Kafka Connect or Kafka MirrorMaker 2) might accept connections to Kafka brokers using server certificates signed by one of the other CAs in the CA chain and not just by the last CA in the chain. This issue is fixed in Strimzi 0.50.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00199 9th percentileScored 2026-11-07
Fix Partial strimzi-kafka-operator (strimzi): 0.51.1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagestrimzi-kafka-operator0.47.0 to before 0.51.10.51.1Patch availableCNA
  • strimzi-kafka-operator Vendorbackstage Affected 0.47.0 to before 0.51.1 Fixed in 0.51.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:strimzi:*:*:*:*:*:*:*:*0.47.0 to before 0.50.1Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:strimzi:*:*:*:*:*:*:*:* Versions 0.47.0 to before 0.50.1 Vulnerable ·backstage

Remediation

  • Fix · CNA strimzi-kafka-operator (strimzi) Fixed in 0.51.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
streams for Apache Kafka 2AffectedNo fix yet: Fix deferred
streams for Apache Kafka 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27133

References

Advisory 1

Other 1

  • TI-2025-41017 Information disclosure in backstage strimzi-kafka-operator CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences