Skip to content
Fencer Vulns
high 8.1

CVE-2026-27134 json

Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication

published 2026-02-20 8 mo ago modified 2026-07-15 3 mo ago also EUVD-2026-7753

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs. It does not affect users using the Strimzi-managed Cluster and Clients CAs. It also does not affect users using custom Cluster or Clients CA with only a single CA (i.e., no CA chain with multiple CAs). This issue has been fixed in version 0.50.1. To workaround this issue, instead of providing the full CA chain as the custom CA, users can provide only the single CA that should be used.

Patch / fix

  • linuxfoundation strimzi_kafka_operator 0.50.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-27134 updated cvss 8.1

strimzi-kafka-operator: Strimzi: Unauthorized authentication via misconfigured mTLS CA chain

  • Red Hat streams for Apache Kafka 2 io.strimzi-strimzi-drain-cleaner Red Hat streams for Apache Kafka 3 io.strimzi-strimzi
    affected: workaround, no fix available
  • Red Hat streams for Apache Kafka 2 io.strimzi-strimzi Red Hat streams for Apache Kafka 3 io.strimzi-strimzi-drain-cleaner
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
8 mo ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • strimzi strimzi-kafka-operator
  • Red Hat streams for Apache Kafka 2
  • Red Hat streams for Apache Kafka 3

Classification

Weakness
  • CWE-287 Improper Authentication
  • CWE-295 Improper Certificate Validation
  • CWE-296 Improper Following of a Certificate's Chain of Trust

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.