{"id":"CVE-2026-55225","aliases":["GHSA-mw9r-p8xp-wx96"],"url":"https://o3.security/vulnerability/CVE-2026-55225","summary":"Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`","details":"### Impact\n\nHaving the Topic and User operators to watch different namespaces than the one where the Kafka cluster is deployed, is a fully documented feature.\n\nWhen the `watchedNamespace` field is used within the Topic or User operator (as part of the `Kafka.spec.entityOperator` field), the Cluster Operator creates a Role granting full CRUD on Secrets into the specified namespace. It also creates a RoleBinding to bind such Role to the entity operator ServiceAccount within the namespace where the Kafka cluster runs.\n\nAn attacker can craft a Kafka custom resource (in an attacker's namespace) with the `watchedNamespace` field set to a target namespace and then they can mint a token for the ServiceAccount (in the attacker's namespace)  to read/write Secrets in that target. This is valid with any target namespace for which the Cluster Operator has the rights (regardless the value of the  `STRIMZI_NAMESPACE` environment variable). The at-risk target namespaces are the namespaces which the user has given permissions to the Cluster Operator for, by creating related RoleBinding(s).\n\n### Patches\n\nThe issue is fixed in Strimzi 1.0.1 and 1.1.0 by adding a control to enable the watched namespace feature through a dedicated environment variable within the Cluster Operator deployment. The watched namespaces feature is disabled by default.\n\n### Workarounds\n\nA possible workaround for this issue is about using a policy agent like Kyverno or OPA to prevent the usage of the `watchedNamespace` at configuration level within the `Kafka` custom resource.","published":"2026-09-15T17:15:51.236Z","modified":"2026-10-21T10:22:31.606290197Z","cvss":{"score":8,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"},"epss":{"score":0.0019,"percentile":0.08868,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.strimzi:strimzi","fixedVersion":"1.0.1"}],"fix":{"url":"https://github.com/strimzi/strimzi-kafka-operator/commit/b3bfeffcc30754c3e62e6f4afd8a76942cac440d","label":"strimzi/strimzi-kafka-operator@b3bfeff"},"references":[{"type":"WEB","url":"https://github.com/strimzi/strimzi-kafka-operator/releases/tag/1.0.1"},{"type":"WEB","url":"https://github.com/strimzi/strimzi-kafka-operator/releases/tag/1.1.0"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55225.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54435"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-55225"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55225.json"},{"type":"ADVISORY","url":"https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-mw9r-p8xp-wx96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55225"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490275"},{"type":"FIX","url":"https://github.com/strimzi/strimzi-kafka-operator/commit/b3bfeffcc30754c3e62e6f4afd8a76942cac440d"},{"type":"FIX","url":"https://github.com/strimzi/strimzi-kafka-operator/commit/f6c5207ba7ec89b46ce6720b8638d647e556a261"},{"type":"FIX","url":"https://github.com/strimzi/strimzi-kafka-operator/pull/12844"},{"type":"PACKAGE","url":"https://github.com/strimzi/strimzi-kafka-operator"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T10:22:31.606290197Z"}}