Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.
Summary
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | strimzi-kafka-operator | before 1.0.1 | 1.0.1 | Patch available | CNA |
| — | io.strimzi:strimzi (Maven) | before 1.0.1 | 1.0.1 | Patch available | GHSA-r427-j2h7-wv3m |
- strimzi-kafka-operator Vendorbackstage Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA
- io.strimzi:strimzi (Maven) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-r427-j2h7-wv3m
Remediation
- Fix · CNA strimzi-kafka-operator (strimzi) Fixed in 1.0.1
- Fix · GHSA-r427-j2h7-wv3m io.strimzi:strimzi (Maven) Fixed in 1.0.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55226
- 2026-10-03 Alias added: GHSA-r427-j2h7-wv3m
References
Other 7
- https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-r427-j2h7-wv3m
- https://github.com/strimzi/strimzi-kafka-operator/pull/12844
- https://github.com/strimzi/strimzi-kafka-operator/commit/b3bfeffcc30754c3e62e6f4afd8a76942cac440d
- https://github.com/strimzi/strimzi-kafka-operator/commit/f6c5207ba7ec89b46ce6720b8638d647e556a261
- https://github.com/strimzi/strimzi-kafka-operator/releases/tag/1.0.1
- https://github.com/strimzi/strimzi-kafka-operator/releases/tag/1.1.0
- https://github.com/strimzi/strimzi-kafka-operator
More backstage vulnerabilities
- TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
- TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
- TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
- TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
- TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
Sources
- CVE-2026-55226 · CVE Program
- CVE-2026-55226 · NVD
- FIRST EPSS
- GHSA-r427-j2h7-wv3m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-55226 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences