Threats affecting pkg:github/strimzi/strimzi-kafka-operator

Strimzi Kafka Operator versions prior to 1.0.1 contain an improper privilege management vulnerability. An attacker able to create a Kafka custom resource can manipulate the entityOperator's watchedNamespace field to cause the operator to create a Role with full Secret CRUD permissions in a target namespace. This Role is bound to a ServiceAccount in the attacker's namespace, allowing the attacker to mint tokens and access Secrets across namespaces where the operator has permissions. The vulnerability is fixed in versions 1.0.1 and 1.1.0 by disabling the watchedNamespace feature by default and requiring explicit enabling.

Strimzi Kafka Operator versions prior to 1.0.1 have an improper privilege management vulnerability where the Entity Operator ServiceAccount retains RBAC permissions for both Topic Operator and User Operator components even when only one is deployed. This can lead to unauthorized access to KafkaUser custom resources and Secrets or KafkaTopic custom resources depending on which operator is absent. The issue is fixed in versions 1.0.1 and 1.1.0.

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The issue is fixed in Strimzi 0.49.1.