Strimzi-kafka-operator versions 1.0.0 and earlier contain an improper privilege management vulnerability (CWE-269) where an attacker with permission to create Kafka custom resources can set the Kafka.spec.entityOperator watchedNamespace to a namespace of their choice. This causes the Cluster Operator to create a Role with full Secret create, read, update, and delete permissions in the target namespace and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for this ServiceAccount and access Secrets in any namespace where the Cluster Operator has permissions, regardless of the STRIMZI_NAMESPACE environment variable. This vulnerability is fixed in versions 1.0.1 and 1.1.0.

An attacker with the ability to create Kafka custom resources can escalate privileges to gain full create, read, update, and delete access to Kubernetes Secrets in arbitrary namespaces where the Cluster Operator has permissions. This can lead to disclosure or manipulation of sensitive information stored as Secrets, potentially compromising confidentiality, integrity, and availability of applications relying on those Secrets.

Upgrade strimzi-kafka-operator to version 1.0.1 or later, as these versions contain the official fix for this vulnerability. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating fixes in versions 1.0.1 and 1.1.0.