Platform
kubernetes
Component
strimzi-kafka-operator
Fixed in
0.47.1
CVE-2026-27133 affects the Strimzi Kafka Operator, a tool for managing Apache Kafka clusters on Kubernetes and OpenShift. This vulnerability arises from an error in how the operator handles CA certificate chains within Kafka Connect and Kafka MirrorMaker 2 operands. Specifically, when multiple CA certificates are used, each certificate is trusted individually, potentially allowing unauthorized connections to the Kafka cluster. Affected versions include 0.47.0 through 0.50.0, with a fix available in version 0.50.1.
The primary impact of CVE-2026-27133 is the potential for unauthorized access to your Apache Kafka cluster. An attacker could exploit this misconfiguration by presenting a certificate that is part of a trusted CA chain, even if it's not intended for legitimate cluster access. This could lead to data breaches, data manipulation, or denial of service. The vulnerability’s scope is limited to deployments using multiple CA certificates in the trusted certificates configuration of Kafka Connect or Kafka MirrorMaker 2 operands. This is not a direct remote code execution vulnerability, but it can be a stepping stone for further attacks if the Kafka cluster itself has other vulnerabilities.
CVE-2026-27133 was publicly disclosed on February 20, 2026. There is currently no indication of active exploitation in the wild. The vulnerability is not listed on the CISA KEV catalog as of this writing. Public proof-of-concept exploits are not yet available, but the vulnerability's nature suggests it could be relatively straightforward to exploit given proper access to the Kubernetes/OpenShift cluster and the ability to modify operand configurations.
Exploit Status
EPSS
0.01% (1% percentile)
CISA SSVC
CVSS Vector
The recommended mitigation for CVE-2026-27133 is to upgrade the Strimzi Kafka Operator to version 0.50.1 or later. This version corrects the faulty certificate chain handling logic. If upgrading is not immediately feasible, consider implementing stricter network policies within your Kubernetes/OpenShift cluster to restrict access to the Kafka cluster. Review your Kafka Connect and Kafka MirrorMaker 2 operand configurations to ensure that only trusted certificates are used and that the CA chain is properly validated. While not a direct fix, consider implementing mutual TLS (mTLS) authentication for all Kafka clients to add an additional layer of security.
Update Strimzi to version 0.50.1 or later. This version corrects the incorrect CA certificate validation in Kafka Connect and Kafka MirrorMaker 2, ensuring that only the last CA certificate in the chain is trusted.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-27133 is a medium-severity vulnerability in Strimzi Kafka Operator versions 0.47.0 through 0.50.0 where misconfigured CA chains allow unauthorized connections to Kafka clusters.
You are affected if you are running Strimzi Kafka Operator versions 0.47.0 through 0.50.0 and using multiple CA certificates in your Kafka Connect or Kafka MirrorMaker 2 operand configurations.
Upgrade Strimzi Kafka Operator to version 0.50.1 or later to resolve the vulnerability. Consider stricter network policies as a temporary workaround.
There is currently no indication of active exploitation in the wild, but the vulnerability is potentially exploitable.
Refer to the official Strimzi project website and security advisories for the latest information: https://strimzi.io/blog/
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.