Auth bypass in Linuxfoundation Strimzi_kafka_operator
CVE-2026-27134
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of m…
Vulnerability class: Broken Authentication
EPSS: 0.004 (28.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linuxfoundation Strimzi_kafka_operator
- Strimzi Strimzi-kafka-operator — versions >= 0.49.0, < 0.50.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-27134?
- CVE-2026-27134 is a high-severity vulnerability in Linuxfoundation Strimzi_kafka_operator, classified under Improper Authentication. CVSS score: 8.1/10. Published 2026-02-21.
- How severe is CVE-2026-27134?
- High severity. CVSS v3 base score is 8.1 out of 10.