CVE-2026-55225

Strimzi, an operator for running Apache Kafka on Kubernetes and OpenShift, contains a privilege management flaw in versions 1.0.0 and earlier. An attacker who is already permitted to create Kafka custom resources can set Kafka.spec.entityOperator.watchedNamespace to any namespace the Cluster Operator has permissions in, which causes the Cluster Operator to create a Role granting full Secret create/read/update/delete permissions in that namespace and bind it to the attacker's Entity Operator ServiceAccount. By minting a token for that ServiceAccount, the attacker can read or write Secrets in any such target namespace, bypassing the intended STRIMZI_NAMESPACE restriction and gaining access to credentials cluster-wide. The issue is rated high severity (CVSS 8.0) and is fixed in Strimzi 1.0.1 and 1.1.0; no public proof of concept or observed in-the-wild exploitation is known. Exposure requires adjacent network access to the Kubernetes API plus the low privilege of Kafka CR creation, making multi-tenant clusters where users can create Strimzi Kafka resources the main at-risk population.

What to do: Upgrade the Strimzi Cluster Operator to 1.0.1 or 1.1.0. Until then, restrict RBAC so only trusted users can create or modify Kafka custom resources (kafka.strimzi.io), and audit existing Kafka CRs for entityOperator.watchedNamespace values pointing outside their own namespace. Also review Roles and RoleBindings created by the operator for the Entity Operator ServiceAccount in unexpected namespaces, and tighten the Cluster Operator's own grants so it only holds Secret permissions in namespaces it genuinely manages.