PT-2025-49308 · Strimzi+3 · Strimzi+5

Published 2025-12-05 · Updated 2026-03-04 · CVE-2025-66623

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strimzi versions 0.47.0 through 0.49.0

Description Strimzi allows running an Apache Kafka cluster on Kubernetes or OpenShift. Versions from 0.47.0 up to 0.49.0 incorrectly create a Kubernetes Role. This role grants Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands GET access to all Kubernetes Secrets within a given Kubernetes namespace.

Recommendations Update to Strimzi version 0.49.1 or later.

Exploit

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

CVE-2025-66623

GHSA-XRHH-HX36-485Q

Affected Products

Apache Kafka

Apache Kafka Connect

Apache Kafka Mirrormaker 2

Kubernetes

Openshift

Strimzi

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66623.json · Exploit
• https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-xrhh-hx36-485q · Vendor Advisory
• https://github.com/strimzi/strimzi-kafka-operator/commit/c8a14935e99c91eb0dd865431f46515da9f82ccc · Patch
• https://osv.dev/vulnerability/CVE-2025-66623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66623 · Security Note
• https://t.me/cveNotify/154199 · Telegram Post
• https://twitter.com/CVEnew/status/1997021628421562716 · Twitter Post
• https://twitter.com/strimziio/status/1996980806774931947 · Twitter Post
• https://t.me/CVEtracker/38961 · Telegram Post
• https://twitter.com/scholzj/status/1998064514370072959 · Twitter Post
• https://twitter.com/scholzj/status/1998063967206248773 · Twitter Post