Skip to content
Fencer Vulns
medium 5.9

CVE-2026-27133 json

Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters

published 2026-02-20 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-7764

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits
0
none known

Summary

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA (Certificate Authority) certificates is used in the trusted certificates configuration of a Kafka Connect operand or of the target cluster in the Kafka MirrorMaker 2 operand, all of the certificates that are part of the CA chain will be trusted individually when connecting to the Apache Kafka cluster. Due to this error, the affected operand (Kafka Connect or Kafka MirrorMaker 2) might accept connections to Kafka brokers using server certificates signed by one of the other CAs in the CA chain and not just by the last CA in the chain. This issue is fixed in Strimzi 0.50.1.

Patch / fix

  • linuxfoundation strimzi 0.50.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-27133 updated cvss 5.9

strimzi-kafka-operator: Strimzi: Improper certificate validation allows unauthorized access via CA chain misconfiguration

  • Red Hat streams for Apache Kafka 2 io.strimzi-strimzi, io.strimzi-strimzi-drain-cleaner Red Hat streams for Apache Kafka 3 io.strimzi-strimzi, io.strimzi-strimzi-drain-cleaner
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
8 mo ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected products

  • strimzi strimzi-kafka-operator

Classification

Weakness
  • CWE-295 Improper Certificate Validation
  • CWE-296 Improper Following of a Certificate's Chain of Trust

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.