PT-2026-20654 · Strimzi+3 · Strimzi+5

Scholzj · Publicado 2026-02-19 · Atualizado 2026-02-25 · CVE-2026-27133

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Strimzi versions 0.47.0 through 0.50.1

Description Strimzi allows running an Apache Kafka cluster on Kubernetes or OpenShift. When multiple Certificate Authority (CA) certificates are used in the trusted certificates configuration of a Kafka Connect operand or a Kafka MirrorMaker 2 operand’s target cluster, all certificates within the CA chain are individually trusted when connecting to the Apache Kafka cluster. This can lead to the affected operand accepting connections from Kafka brokers using server certificates signed by any CA in the chain, rather than only the final CA.

Recommendations Update to version 0.50.1 or later.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

CWE-296

Identificadores relacionados

CVE-2026-27133

GHSA-6X85-J2F7-4XC5

Produtos afetados

Apache Kafka

Kafka Connect

Kafka Mirrormaker 2

Kubernetes

Openshift

Strimzi

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27133.json · Exploit
• https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1 · Nota
• https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-6x85-j2f7-4xc5 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2024988711478612051 · Publicação no Twitter
• https://t.me/cveNotify/153215 · Publicação no Telegram
• https://twitter.com/strimziio/status/2024281572598309115 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27133 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27133 · Aviso do Fabricante