CVE-2026-27134
Received Received - Intake
Improper mTLS CA Validation in Strimzi Kafka Causes Authentication Bypass

Publication date: 2026-02-21

Last updated on: 2026-02-25

Assigner: GitHub, Inc.

Description
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs. It does not affect users using the Strimzi-managed Cluster and Clients CAs. It also does not affect users using custom Cluster or Clients CA with only a single CA (i.e., no CA chain with multiple CAs). This issue has been fixed in version 0.50.1. To workaround this issue, instead of providing the full CA chain as the custom CA, users can provide only the single CA that should be used.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-21
Last Modified
2026-02-25
Generated
2026-06-16
AI Q&A
2026-02-21
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27134
EUVD
EUVD-2026-7753
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linuxfoundation strimzi_kafka_operator From 0.49.0 (inc) to 0.50.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-296 The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-27134 is a vulnerability in Strimzi Kafka Operator versions 0.49.0 through 0.50.0 related to the handling of custom Certificate Authority (CA) chains used for mutual TLS (mTLS) authentication. When a custom Cluster or Clients CA is configured with a multistage CA chain containing multiple CAs, Strimzi incorrectly trusts all CAs in the chain for mTLS authentication on both internal and user-configured listeners.

This misconfiguration allows any user with a certificate signed by any CA in the chain to authenticate successfully, even if they should not be trusted. The issue only affects users using a custom CA with multiple CAs in the chain and does not affect those using Strimzi-managed CAs or a single CA.

The vulnerability was fixed in Strimzi version 0.50.1, and a workaround is to provide only the single CA intended for trust instead of the full CA chain.

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to authenticate to the Kafka cluster if they possess a certificate signed by any CA in the multistage CA chain. Because Strimzi trusts all CAs in the chain, users with certificates from any CA in the chain can gain access.

This can lead to a compromise of confidentiality, integrity, and availability of the Kafka cluster, as unauthorized users could potentially access sensitive data, interfere with broker replication and control plane communication, or disrupt services.

The vulnerability has a high severity with a CVSS v3.1 base score of 8.1, indicating significant potential impact.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Strimzi Kafka Operator to version 0.50.1 or later, where the issue has been fixed.

If upgrading immediately is not possible, as a workaround, provide only the single Certificate Authority (CA) that should be trusted instead of the full multistage CA chain when configuring the custom Cluster or Clients CA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27134. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart