CVE-2026-27134: CWE-287: Improper Authentication in strimzi strimzi-kafka-operator
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs. It does not affect users using the Strimzi-managed Cluster and Clients CAs. It also does not affect users using custom Cluster or Clients CA with only a single CA (i.e., no CA chain with multiple CAs). This issue has been fixed in version 0.50.1. To workaround this issue, instead of providing the full CA chain as the custom CA, users can provide only the single CA that should be used.
AI Analysis
Technical Summary
Strimzi Kafka Operator versions 0.49.0 through 0.50.0 improperly configure trusted certificates for mutual TLS authentication when a custom Cluster or Clients CA uses a multistage CA chain. All CAs in the chain are trusted, enabling authentication by any certificate signed by any CA in the chain. This vulnerability affects only configurations with a multistage CA chain and not those using Strimzi-managed CAs or single custom CAs. The issue is resolved in version 0.50.1. The vendor advisory from Red Hat confirms this and suggests a workaround of providing only the single CA instead of the full chain.
Potential Impact
The vulnerability allows users with certificates signed by any CA in the multistage CA chain to authenticate to the Kafka cluster, potentially bypassing intended authentication restrictions. This could lead to unauthorized access with high confidentiality, integrity, and availability impact as indicated by the CVSS score of 8.1.
Mitigation Recommendations
An official fix is available in Strimzi Kafka Operator version 0.50.1. Users should upgrade to this version to resolve the issue. As a temporary workaround, users can provide only the single CA that should be trusted instead of the full CA chain when configuring custom Cluster or Clients CAs. This issue does not affect users using Strimzi-managed CAs or single custom CAs.
CVE-2026-27134: CWE-287: Improper Authentication in strimzi strimzi-kafka-operator
Description
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs. It does not affect users using the Strimzi-managed Cluster and Clients CAs. It also does not affect users using custom Cluster or Clients CA with only a single CA (i.e., no CA chain with multiple CAs). This issue has been fixed in version 0.50.1. To workaround this issue, instead of providing the full CA chain as the custom CA, users can provide only the single CA that should be used.
CVSS v3.1
Score 8.1high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Strimzi Kafka Operator versions 0.49.0 through 0.50.0 improperly configure trusted certificates for mutual TLS authentication when a custom Cluster or Clients CA uses a multistage CA chain. All CAs in the chain are trusted, enabling authentication by any certificate signed by any CA in the chain. This vulnerability affects only configurations with a multistage CA chain and not those using Strimzi-managed CAs or single custom CAs. The issue is resolved in version 0.50.1. The vendor advisory from Red Hat confirms this and suggests a workaround of providing only the single CA instead of the full chain.
Potential Impact
The vulnerability allows users with certificates signed by any CA in the multistage CA chain to authenticate to the Kafka cluster, potentially bypassing intended authentication restrictions. This could lead to unauthorized access with high confidentiality, integrity, and availability impact as indicated by the CVSS score of 8.1.
Mitigation Recommendations
An official fix is available in Strimzi Kafka Operator version 0.50.1. Users should upgrade to this version to resolve the issue. As a temporary workaround, users can provide only the single CA that should be trusted instead of the full CA chain when configuring custom Cluster or Clients CAs. This issue does not affect users using Strimzi-managed CAs or single custom CAs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-02-17T18:42:27.044Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-27134","vendor":"Red Hat"}]
Threat ID: 6998eb7cbe58cf853bdd2aac
Added to database: 02/20/2026, 23:17:16 UTC
Last enriched: 07/15/2026, 08:43:16 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 379
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.