Certificate Authority Trust Issue in Strimzi Kafka Connect and MirrorMaker 2
CVE-2026-27133

5.9MEDIUM

Key Information:

Vendor

Strimzi

Status
Strimzi-kafka-operator
Vendor
CVE Published:
20 February 2026

What is CVE-2026-27133?

Strimzi, a tool for deploying Apache Kafka on Kubernetes or OpenShift, has identified a vulnerability affecting versions 0.47.0 through 0.49.0. This vulnerability exists when a chain of multiple Certificate Authority (CA) certificates is used in the trusted certificates configuration for either the Kafka Connect operand or the Kafka MirrorMaker 2 operand. In this scenario, any CA certificate in the chain will be accepted individually, allowing potentially untrusted server certificates that are signed by other CAs in the chain to be trusted when connecting to the Kafka cluster. This could lead to unauthorized access and communication with the Kafka brokers. This issue has been resolved in Strimzi version 0.50.1, where proper validation of the CA chain has been enforced.

Affected Version(s)

strimzi-kafka-operator >= 0.47.0, < 0.51.1

References

https://github.com/strimzi/strimzi-kafka-operator/securit...
x_refsource_CONFIRM
https://github.com/strimzi/strimzi-kafka-operator/release...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.