CVE-2026-27134 describes an authentication bypass vulnerability in Strimzi Kafka Operator versions 0.49.0 through 0.50.0. When using a custom multistage Certificate Authority (CA) chain for mTLS authentication, Strimzi incorrectly trusts all CAs in the chain, allowing users with certificates signed by any CA in that chain to authenticate, even if they shouldn't. This high-severity vulnerability (CVSS 8.1) has a network attack vector and high impact on confidentiality, integrity, and availability, but requires high attack complexity. There is no evidence of active exploitation, public exploit code, or significant community discussion beyond a single mention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.49.0, < 0.50.1CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:strimzi_kafka_operator:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.