PT-2026-20654 · Strimzi+3 · Strimzi+5

Scholzj · Published 2026-02-19 · Updated 2026-02-25 · CVE-2026-27133

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Strimzi versions 0.47.0 through 0.50.1

Description Strimzi allows running an Apache Kafka cluster on Kubernetes or OpenShift. When multiple Certificate Authority (CA) certificates are used in the trusted certificates configuration of a Kafka Connect operand or a Kafka MirrorMaker 2 operand’s target cluster, all certificates within the CA chain are individually trusted when connecting to the Apache Kafka cluster. This can lead to the affected operand accepting connections from Kafka brokers using server certificates signed by any CA in the chain, rather than only the final CA.

Recommendations Update to version 0.50.1 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-296

Related Identifiers

CVE-2026-27133

GHSA-6X85-J2F7-4XC5

Affected Products

Apache Kafka

Kafka Connect

Kafka Mirrormaker 2

Kubernetes

Openshift

Strimzi

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27133.json · Exploit
• https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-6x85-j2f7-4xc5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27133 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27133 · Vendor Advisory
• https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.50.1 · Note
• https://twitter.com/CVEnew/status/2024988711478612051 · Twitter Post
• https://t.me/cveNotify/153215 · Telegram Post
• https://twitter.com/strimziio/status/2024281572598309115 · Twitter Post