HIGH🇵🇱 Wersja polska

CVE-2025-66623

CVSS 7.4v3.1pub. 2025-12-05upd. 2026-03-04

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The issue is fixed in Strimzi 0.49.1.

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

  • Linuxfoundation Strimzi

    APP
    Linuxfoundation
    < 0.49.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Container
CWE
References

Related vulnerabilities

CVE-2026-27133MEDIUM5.9ten sam produkt

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configu...

CVE-2026-53488CRITICAL9.4ten sam vendor

containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 t...

CVE-2026-44477CRITICAL9.4PL ✓ten sam vendor

CloudNativePG: eskalacja uprawnień do superużytkownika PostgreSQL przez metrics exporter

CVE-2026-37531CRITICAL9.8PL ✓ten sam vendor

AGL app-framework-main: Zip Slip + TOCTOU umożliwiają zapis dowolnych plików

CVE-2026-32613CRITICAL9.9PL ✓ten sam vendor

Spinnaker Echo: nieograniczony dostęp SPeL umożliwia RCE