CVE-2026-27134

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27134", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T18:42:27.044Z", "datePublished": "2026-02-20T23:05:04.320Z", "dateUpdated": "2026-07-15T01:14:38.593Z"}, "containers": {"cna": {"title": "Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-296", "lang": "en", "description": "CWE-296: Improper Following of a Certificate's Chain of Trust", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-2qwx-rq6j-8r6j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-2qwx-rq6j-8r6j"}, {"name": "https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1"}], "affected": [{"vendor": "strimzi", "product": "strimzi-kafka-operator", "versions": [{"version": ">= 0.49.0, < 0.50.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T23:05:04.320Z"}, "descriptions": [{"lang": "en", "value": "Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs. It does not affect users using the Strimzi-managed Cluster and Clients CAs. It also does not affect users using custom Cluster or Clients CA with only a single CA (i.e., no CA chain with multiple CAs). This issue has been fixed in version 0.50.1. To workaround this issue, instead of providing the full CA chain as the custom CA, users can provide only the single CA that should be used."}], "source": {"advisory": "GHSA-2qwx-rq6j-8r6j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T21:31:51.539855Z", "id": "CVE-2026-27134", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:32:00.282Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:2"], "defaultStatus": "unaffected", "packageName": "io.strimzi-strimzi", "product": "streams for Apache Kafka 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:2"], "defaultStatus": "affected", "packageName": "io.strimzi-strimzi-drain-cleaner", "product": "streams for Apache Kafka 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:3"], "defaultStatus": "affected", "packageName": "io.strimzi-strimzi", "product": "streams for Apache Kafka 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:3"], "defaultStatus": "unaffected", "packageName": "io.strimzi-strimzi-drain-cleaner", "product": "streams for Apache Kafka 3", "vendor": "Red Hat"}], "datePublic": "2026-02-20T23:05:04.320Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Strimzi. When using a custom Cluster or Clients Certificate Authority (CA) with a multistage CA chain, Strimzi incorrectly configures the trusted certificates for mutual Transport Layer Security (mTLS) authentication. This allows users with certificates signed by any CA in the chain to authenticate, even if they are not intended to be trusted. This could lead to unauthorized access and potential information disclosure or other impacts within the Kafka cluster."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-27134"}, {"name": "RHBZ#2441564", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441564"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27134.json"}], "timeline": [{"lang": "en", "time": "2026-02-21T00:01:56.960Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-02-20T23:05:04.320Z", "value": "Made public."}], "title": "strimzi-kafka-operator: Strimzi: Unauthorized authentication via misconfigured mTLS CA chain", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:14:38.593Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "strimzi-kafka-operator: Strimzi: Unauthorized authentication via misconfigured mTLS CA chain", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:amq_streams:2"], "vendor": "Red Hat", "product": "streams for Apache Kafka 2", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:amq_streams:3"], "vendor": "Red Hat", "product": "streams for Apache Kafka 3", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-02-21T00:01:56.960Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-02-20T23:05:04.320Z", "value": "Made public."}], "x_adpType": "supplier", "datePublic": "2026-02-20T23:05:04.320Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-27134", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441564", "name": "RHBZ#2441564", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27134.json", "tags": ["x_sadp-csaf-vex"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Strimzi. When using a custom Cluster or Clients Certificate Authority (CA) with a multistage CA chain, Strimzi incorrectly configures the trusted certificates for mutual Transport Layer Security (mTLS) authentication. This allows users with certificates signed by any CA in the chain to authenticate, even if they are not intended to be trusted. This could lead to unauthorized access and potential information disclosure or other impacts within the Kafka cluster."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-06-30T12:08:09.029Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27134", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T21:31:51.539855Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:31:55.788Z"}}], "cna": {"title": "Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication", "source": {"advisory": "GHSA-2qwx-rq6j-8r6j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "strimzi", "product": "strimzi-kafka-operator", "versions": [{"status": "affected", "version": ">= 0.49.0, < 0.50.1"}]}], "references": [{"url": "https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-2qwx-rq6j-8r6j", "name": "https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-2qwx-rq6j-8r6j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1", "name": "https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs. It does not affect users using the Strimzi-managed Cluster and Clients CAs. It also does not affect users using custom Cluster or Clients CA with only a single CA (i.e., no CA chain with multiple CAs). This issue has been fixed in version 0.50.1. To workaround this issue, instead of providing the full CA chain as the custom CA, users can provide only the single CA that should be used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-296", "description": "CWE-296: Improper Following of a Certificate's Chain of Trust"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T23:05:04.320Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27134", "state": "PUBLISHED", "dateUpdated": "2026-06-30T12:08:09.029Z", "dateReserved": "2026-02-17T18:42:27.044Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-20T23:05:04.320Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "strimzi-kafka-operator", "vendor": "strimzi", "versions": [{"status": "affected", "version": ">= 0.49.0, < 0.50.1"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:2"], "defaultStatus": "unaffected", "packageName": "io.strimzi-strimzi", "product": "streams for Apache Kafka 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:2"], "defaultStatus": "affected", "packageName": "io.strimzi-strimzi-drain-cleaner", "product": "streams for Apache Kafka 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:3"], "defaultStatus": "affected", "packageName": "io.strimzi-strimzi", "product": "streams for Apache Kafka 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:3"], "defaultStatus": "unaffected", "packageName": "io.strimzi-strimzi-drain-cleaner", "product": "streams for Apache Kafka 3", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:strimzi_kafka_operator:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7602B49-F655-4497-890A-3FA585C739FD", "versionEndExcluding": "0.50.1", "versionStartIncluding": "0.49.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs. It does not affect users using the Strimzi-managed Cluster and Clients CAs. It also does not affect users using custom Cluster or Clients CA with only a single CA (i.e., no CA chain with multiple CAs). This issue has been fixed in version 0.50.1. To workaround this issue, instead of providing the full CA chain as the custom CA, users can provide only the single CA that should be used."}, {"lang": "es", "value": "Strimzi proporciona una forma de ejecutar un cl\u00faster de Apache Kafka en Kubernetes u OpenShift en varias configuraciones de despliegue. En las versiones 0.49.0 a 0.50.0, al usar una CA de cl\u00faster o clientes personalizada con una cadena de CA multifase que consta de m\u00faltiples CA, Strimzi configura incorrectamente los certificados de confianza para la autenticaci\u00f3n mTLS tanto en los oyentes internos como en los configurados por el usuario. Todas las CA de la cadena de CA ser\u00e1n de confianza. Y los usuarios con certificados firmados por cualquiera de las CA de la cadena podr\u00e1n autenticarse. Este problema afecta solo a los usuarios que usan una CA de cl\u00faster o clientes personalizada con una cadena de CA multifase que consta de m\u00faltiples CA. No afecta a los usuarios que usan las CA de cl\u00faster y clientes gestionadas por Strimzi. Tampoco afecta a los usuarios que usan una CA de cl\u00faster o clientes personalizada con solo una \u00fanica CA (es decir, sin cadena de CA con m\u00faltiples CA). Este problema ha sido solucionado en la versi\u00f3n 0.50.1. Como soluci\u00f3n alternativa a este problema, en lugar de proporcionar la cadena de CA completa como la CA personalizada, los usuarios pueden proporcionar solo la \u00fanica CA que debe usarse."}], "id": "CVE-2026-27134", "lastModified": "2026-07-15T02:19:03.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27134", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T21:31:51.539855Z", "version": "2.0.3"}}]}, "published": "2026-02-21T00:16:15.940", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-2qwx-rq6j-8r6j"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-27134"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441564"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27134.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-296"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-295"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "strimzi-kafka-operator: Strimzi: Unauthorized authentication via misconfigured mTLS CA chain", "id": "2441564", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441564"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-295", "details": ["Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs. It does not affect users using the Strimzi-managed Cluster and Clients CAs. It also does not affect users using custom Cluster or Clients CA with only a single CA (i.e., no CA chain with multiple CAs). This issue has been fixed in version 0.50.1. To workaround this issue, instead of providing the full CA chain as the custom CA, users can provide only the single CA that should be used."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-27134", "package_state": [{"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Affected", "package_name": "io.strimzi-strimzi", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Affected", "package_name": "io.strimzi-strimzi-drain-cleaner", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Affected", "package_name": "io.strimzi-strimzi", "product_name": "streams for Apache Kafka 3"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Affected", "package_name": "io.strimzi-strimzi-drain-cleaner", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-02-20T23:05:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-27134\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27134\nhttps://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1\nhttps://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-2qwx-rq6j-8r6j"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.49.0,0.50.1)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "strimzi-kafka-operator", "source": "cna", "vendor": "strimzi"}, "product": "kafka-operator", "vendor": "strimzi"}], "analysis": {"en": {"generated_at": "2026-04-17T17:00:07.974296+00:00", "value": {"mitigation_remediation": ["Upgrade Strimzi Kafka operator to version 0.50.1 or later", "If an upgrade is not immediately possible, configure the custom CA to use only a single CA instead of the full chain", "Review and limit the set of trusted CAs for mTLS to the intended CA only and monitor for unexpected certificate usage"], "summary": {"action": "Apply Patch", "impact": "Authentication Bypass via MTLS"}, "threat_synthesis": {"affected_systems": "The affected product is Strimzi Kafka operator. Versions 0.49.0 through 0.50.0 that use a custom Cluster or Clients CA with a multistage CA chain are impacted. Single\u2011CA custom CAs or Strimzi\u2011managed CAs are not affected.", "description_and_impact": "In Strimzi Kafka operator versions 0.49.0 through 0.50.0, a custom multistage CA chain is incorrectly configured to trust every certificate authority in the chain for mutual TLS authentication. This permits any user certificate signed by any CA in the chain to authenticate successfully. The vulnerability results in unauthorized access to Kafka internals and user-configured listeners, effectively bypassing intended authentication controls.", "risk_and_exploitability": "The CVSS score of 8.1 indicates high severity. The EPSS score is less than 1%, suggesting the likelihood of exploitation is currently low, but the vulnerability is not listed in the CISA KEV catalog. An attacker would need access to a client certificate signed by any CA in the custom chain, which is feasible if the CA hierarchy is exposed or misused. Trusted CAs are incorrectly accepted, making it possible to impersonate legitimate users without knowledge of the primary CA."}}}}, "created": "2026-02-23T14:33:08.404997+00:00", "updated": "2026-04-17T17:00:10.208015+00:00", "vendors": ["strimzi", "strimzi$PRODUCT$kafka-operator"]}