Skip to content
Fencer Vulns
high 8.0

CVE-2026-55225 json

Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

published 2026-06-18 4 mo ago modified 2026-09-30 39 d ago also EUVD-2026-78883 , GHSA-mw9r-p8xp-wx96

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. This issue is fixed in versions 1.0.1 and 1.1.0.

Patch / fix

  • maven io.strimzi:strimzi 1.0.1
  • io.strimzi strimzi 1.0.1
  • linuxfoundation strimzi_kafka_operator 1.0.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-55225 updated cvss 8.0

strimzi-cluster-operator: Cross-namespace privilege escalation via Kafka.spec.entityOperator.watchedNamespace in Strimzi

  • Red Hat streams for Apache Kafka 2 cluster-operator
    affected: workaround, no fix available
  • Red Hat Streams for Apache Kafka 3.2.1
    fixed: vendor fix RHSA-2026:54435

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
54 d ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADP 3.1 8.0 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 8.0 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven io.strimzi:strimzi
<1.0.1
1.0.1

Affected products

  • strimzi strimzi-kafka-operator
  • Red Hat Streams for Apache Kafka 3.2.1
  • Red Hat streams for Apache Kafka 2

Classification

Weakness
  • CWE-269 Improper Privilege Management
  • CWE-441 Unintended Proxy or Intermediary
  • CWE-250 Execution with Unnecessary Privileges

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.