Strimzi 所有 CA 链中的 CA 证书都将在 Kafka Connect 和 Kafka MirrorMaker 2 目标集群中被信任
平台
kubernetes
组件
strimzi-kafka-operator
修复版本
0.47.1
CVE-2026-27133 affects the Strimzi Kafka Operator, a tool for managing Apache Kafka clusters on Kubernetes and OpenShift. This vulnerability arises from an error in how the operator handles CA certificate chains within Kafka Connect and Kafka MirrorMaker 2 operands. Specifically, when multiple CA certificates are used, each certificate is trusted individually, potentially allowing unauthorized connections to the Kafka cluster. Affected versions include 0.47.0 through 0.50.0, with a fix available in version 0.50.1.
影响与攻击场景翻译中…
The primary impact of CVE-2026-27133 is the potential for unauthorized access to your Apache Kafka cluster. An attacker could exploit this misconfiguration by presenting a certificate that is part of a trusted CA chain, even if it's not intended for legitimate cluster access. This could lead to data breaches, data manipulation, or denial of service. The vulnerability’s scope is limited to deployments using multiple CA certificates in the trusted certificates configuration of Kafka Connect or Kafka MirrorMaker 2 operands. This is not a direct remote code execution vulnerability, but it can be a stepping stone for further attacks if the Kafka cluster itself has other vulnerabilities.
利用背景翻译中…
CVE-2026-27133 was publicly disclosed on February 20, 2026. There is currently no indication of active exploitation in the wild. The vulnerability is not listed on the CISA KEV catalog as of this writing. Public proof-of-concept exploits are not yet available, but the vulnerability's nature suggests it could be relatively straightforward to exploit given proper access to the Kubernetes/OpenShift cluster and the ability to modify operand configurations.
哪些人处于风险中翻译中…
Organizations utilizing Strimzi Kafka Operator for managing Kafka clusters on Kubernetes or OpenShift, particularly those employing multiple CA certificates in their Kafka Connect or Kafka MirrorMaker 2 operand configurations, are at risk. This includes those with complex certificate management setups and those who may have inherited configurations without fully understanding their implications.
检测步骤翻译中…
• kubernetes / server:
kubectl get pods -n <namespace> -l app.strimzi.io/operator=kafka-operator -o jsonpath='{.items[*].metadata.labels.version}'• kubernetes / server:
kubectl get kafkaconnect -n <namespace> -o yaml | grep -i ca-chain• kubernetes / server:
kubectl get kafkamirror -n <namespace> -o yaml | grep -i ca-chain攻击时间线
- Disclosure
disclosure
威胁情报
漏洞利用状态
EPSS
0.01% (1% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 高 — 需要竞态条件、非默认配置或特定情况。难以可靠利用。
- Privileges Required
- 高 — 需要管理员或特权账户。
- User Interaction
- 无 — 攻击自动且无声，受害者无需任何操作。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 高 — 完全丧失机密性，攻击者可读取所有数据。
- Integrity
- 高 — 攻击者可写入、修改或删除任何数据。
- Availability
- 无 — 无可用性影响。
受影响的软件
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The recommended mitigation for CVE-2026-27133 is to upgrade the Strimzi Kafka Operator to version 0.50.1 or later. This version corrects the faulty certificate chain handling logic. If upgrading is not immediately feasible, consider implementing stricter network policies within your Kubernetes/OpenShift cluster to restrict access to the Kafka cluster. Review your Kafka Connect and Kafka MirrorMaker 2 operand configurations to ensure that only trusted certificates are used and that the CA chain is properly validated. While not a direct fix, consider implementing mutual TLS (mTLS) authentication for all Kafka clients to add an additional layer of security.
修复方法
将 Strimzi 更新到 0.50.1 或更高版本。此版本修复了 Kafka Connect 和 Kafka MirrorMaker 2 中 CA 证书验证不正确的问题，确保仅信任链中的最后一个 CA 证书。
CVE 安全通讯
漏洞分析和关键警报直接发送到您的邮箱。
常见问题翻译中…
What is CVE-2026-27133 — Certificate Trust Issue in Strimzi Kafka Operator?
CVE-2026-27133 is a medium-severity vulnerability in Strimzi Kafka Operator versions 0.47.0 through 0.50.0 where misconfigured CA chains allow unauthorized connections to Kafka clusters.
Am I affected by CVE-2026-27133 in Strimzi Kafka Operator?
You are affected if you are running Strimzi Kafka Operator versions 0.47.0 through 0.50.0 and using multiple CA certificates in your Kafka Connect or Kafka MirrorMaker 2 operand configurations.
How do I fix CVE-2026-27133 in Strimzi Kafka Operator?
Upgrade Strimzi Kafka Operator to version 0.50.1 or later to resolve the vulnerability. Consider stricter network policies as a temporary workaround.
Is CVE-2026-27133 being actively exploited?
There is currently no indication of active exploitation in the wild, but the vulnerability is potentially exploitable.
Where can I find the official Strimzi advisory for CVE-2026-27133?
Refer to the official Strimzi project website and security advisories for the latest information: https://strimzi.io/blog/