SECUFOCUSNOW
Home›CVE index›CVE-2026-27134
Review reviewHigh

CVE-2026-27134

strimzi strimzi-kafka-operator, streams for Apache Kafka 2, streams for Apache Kafka 3

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a...

CVSS
8.1
EPSS
0.36%
29.2% percentile
CISA KEV
Not listed
Published
2026.02.21
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.36%
Technical severityCVSS 8.1

Vulnerability overview

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a...

Affected product and versions

Product
strimzi strimzi-kafka-operator, streams for Apache Kafka 2, streams for Apache Kafka 3
Affected versions
>= >= 0.49.0, < 0.50.1, >= 0.49.0 < 0.50.1
Fixed versions
0.50.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that strimzi strimzi-kafka-operator, streams for Apache Kafka 2, streams for Apache Kafka 3 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-287, CWE-295, CWE-296