{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-55225", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T16:16:32.628Z", "datePublished": "2026-09-15T17:15:51.236Z", "dateUpdated": "2026-09-16T12:04:21.530Z" }, "containers": { "cna": { "title": "Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-441", "lang": "en", "description": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')", "type": "CWE" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" } } ], "references": [ { "name": "https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-mw9r-p8xp-wx96", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-mw9r-p8xp-wx96" }, { "name": "https://github.com/strimzi/strimzi-kafka-operator/pull/12844", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/strimzi/strimzi-kafka-operator/pull/12844" }, { "name": "https://github.com/strimzi/strimzi-kafka-operator/commit/b3bfeffcc30754c3e62e6f4afd8a76942cac440d", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/strimzi/strimzi-kafka-operator/commit/b3bfeffcc30754c3e62e6f4afd8a76942cac440d" }, { "name": "https://github.com/strimzi/strimzi-kafka-operator/commit/f6c5207ba7ec89b46ce6720b8638d647e556a261", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/strimzi/strimzi-kafka-operator/commit/f6c5207ba7ec89b46ce6720b8638d647e556a261" }, { "name": "https://github.com/strimzi/strimzi-kafka-operator/releases/tag/1.0.1", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/strimzi/strimzi-kafka-operator/releases/tag/1.0.1" }, { "name": "https://github.com/strimzi/strimzi-kafka-operator/releases/tag/1.1.0", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/strimzi/strimzi-kafka-operator/releases/tag/1.1.0" } ], "affected": [ { "vendor": "strimzi", "product": "strimzi-kafka-operator", "versions": [ { "version": "< 1.0.1", "status": "affected" } ] } ], "providerMetadata": { "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-15T17:15:51.236Z" }, "descriptions": [ { "lang": "en", "value": "Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. This issue is fixed in versions 1.0.1 and 1.1.0." } ], "source": { "advisory": "GHSA-mw9r-p8xp-wx96", "discovery": "UNKNOWN" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-09-15T19:02:30.423631Z", "id": "CVE-2026-55225", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T19:44:47.681Z" } }, { "affected": [ { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:amq_streams:3.2::el9" ], "defaultStatus": "unaffected", "packageName": "cluster-operator", "product": "Streams for Apache Kafka 3.2.1", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:amq_streams:2" ], "defaultStatus": "affected", "packageName": "cluster-operator", "product": "streams for Apache Kafka 2", "vendor": "Red Hat" } ], "datePublic": "2026-06-17T00:00:00.000Z", "descriptions": [ { "lang": "en", "value": "When the Strimzi cluster operator is deployed with watchAnyNamespace=true (or a multi-namespace list), any namespace editor can set Kafka.spec.entityOperator.userOperator.watchedNamespace (or topicOperator.watchedNamespace) to an arbitrary namespace. The cluster operator then creates a Role granting full CRUD on Secrets in the target namespace and a RoleBinding pointing to a ServiceAccount in the attacker's namespace — effectively granting cluster-admin-equivalent access via kube-system secret exfiltration. The RBAC objects created cross-namespace have their ownerReferences deliberately stripped, making the privilege grant persistent even after the Kafka CR or attacker namespace is deleted. Fixed in Strimzi 1.0.1 and 1.1.0 by adding a dedicated environment variable to explicitly enable the watched namespace feature (disabled by default)." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-250", "description": "Execution with Unnecessary Privileges", "lang": "en", "type": "CWE" } ] } ], "references": [ { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2026-55225" }, { "name": "RHBZ#2490275", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490275" }, { "tags": [ "x_sadp-csaf-vex" ], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55225.json" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:54435" } ], "solutions": [ { "lang": "en", "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1" } ], "timeline": [ { "lang": "en", "time": "2026-05-20T00:00:00.000Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-06-17T00:00:00.000Z", "value": "Made public." } ], "title": "strimzi-cluster-operator: Cross-namespace privilege escalation via Kafka.spec.entityOperator.watchedNamespace in Strimzi", "workarounds": [ { "lang": "en", "value": "For users who cannot upgrade immediately, deploy a Kubernetes admission policy agent (such as Kyverno or OPA Gatekeeper) to block or restrict the use of the `watchedNamespace` field in Kafka custom resources (`Kafka.spec.entityOperator.userOperator.watchedNamespace` and `Kafka.spec.entityOperator.topicOperator.watchedNamespace`). Additionally, audit existing Kafka custom resources for unexpected `watchedNamespace` configurations and review RoleBindings in sensitive namespaces." } ], "x_adpType": "supplier", "x_generator": { "engine": "sadp-cli 1.0.0" }, "providerMetadata": { "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-16T12:04:21.530Z" } } ] } }