CVE-2026-55225
Received Received - Intake

Privilege Escalation in Strimzi via Role Binding Misconfiguration

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. This issue is fixed in versions 1.0.1 and 1.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55225
EUVD
EUVD-2026-78883

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
strimzi strimzi to 1.0.1 (exc)
strimzi strimzi From 1.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Strimzi allows an attacker who can create a Kafka custom resource to set a target namespace for the Entity Operator. This causes the Cluster Operator to create a Role with full Secret CRUD permissions in that namespace and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can then use a minted token to read or write Secrets in any target namespace where the Cluster Operator has permissions.

Detection Guidance

Check Strimzi versions for 1.0.0 or earlier. Inspect Kafka custom resources for unexpected watchedNamespace settings. Review Role and RoleBinding objects in namespaces where the Cluster Operator operates for unauthorized Secret CRUD permissions.

Impact Analysis

An attacker could exploit this to gain unauthorized access to Secrets in your namespace, potentially exposing sensitive data like credentials, certificates, or configuration details. This could lead to further attacks, data breaches, or unauthorized modifications to your system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). It may result in data breaches, unauthorized disclosures, or loss of control over personal or health-related data, leading to legal and regulatory penalties.

Mitigation Strategies

Upgrade Strimzi to version 1.0.1 or 1.1.0 or later. Remove any unauthorized Role or RoleBinding objects granting Secret CRUD permissions. Restrict access to create or modify Kafka custom resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55225. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart