What is the CVSS score of EUVD-2026-78883?

EUVD-2026-78883 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.

Which versions of Strimzi Kafka Operator are affected by EUVD-2026-78883?

Strimzi Kafka Operator versions up to 1.0.0 contain a cross-namespace privilege escalation vulnerability (CVE-2026-55225) that allows cluster users with basic Kafka resource creation rights to read…. A patch is available.

How to fix or mitigate EUVD-2026-78883?

Within 24 hours: Identify all Strimzi Kafka Operator deployments, document versions and cluster tenancy model, and assess which instances run version 1.0.0 or earlier in multi-tenant environments. Within 7 days: Apply RBAC restrictions to Cluster Operator ServiceAccount to limit Secret access to explicitly required namespaces, remove or disable the watchedNamespace field in affected Kafka.spec.entityOperator configurations, and audit entity operator role bindings. Within 30 days: Prepare upgrade path and establish automated testing for patch validation; upon vendor release of patched version, test in staging and deploy to production.

Strimzi Kafka Operator EUVD-2026-78883

| CVE-2026-55225 HIGH

Improper Privilege Management (CWE-269)

2026-06-18 https://github.com/strimzi/strimzi-kafka-operator

GHSA-mw9r-p8xp-wx96

Privilege Escalation

8.0

CVSS 3.1 · Vendor: https://github.com/strimzi/strimzi-kafka-operator

Severity by source

Vendor (https://github.com/strimzi/strimzi-kafka-operator) PRIMARY

8.0 HIGH

AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Kubernetes API is network-reachable so AV:N; only namespace tenant rights needed (PR:L); scope changes across namespaces (S:C) with full Secret read/write (C:H/I:H) but no direct availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Red Hat

8.0 HIGH

qualitative

Primary rating from Vendor (https://github.com/strimzi/strimzi-kafka-operator).

CVSS VectorVendor: https://github.com/strimzi/strimzi-kafka-operator

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 18, 2026 - 14:00 vuln.today

Analysis Generated

Jun 18, 2026 - 14:00 vuln.today

DescriptionCVE.org

Impact

Having the Topic and User operators to watch different namespaces than the one where the Kafka cluster is deployed, is a fully documented feature.

When the watchedNamespace field is used within the Topic or User operator (as part of the Kafka.spec.entityOperator field), the Cluster Operator creates a Role granting full CRUD on Secrets into the specified namespace. It also creates a RoleBinding to bind such Role to the entity operator ServiceAccount within the namespace where the Kafka cluster runs.

An attacker can craft a Kafka custom resource (in an attacker's namespace) with the watchedNamespace field set to a target namespace and then they can mint a token for the ServiceAccount (in the attacker's namespace) to read/write Secrets in that target. This is valid with any target namespace for which the Cluster Operator has the rights (regardless the value of the STRIMZI_NAMESPACE environment variable). The at-risk target namespaces are the namespaces which the user has given permissions to the Cluster Operator for, by creating related RoleBinding(s).

Patches

The issue is fixed in Strimzi 1.0.1 and 1.1.0 by adding a control to enable the watched namespace feature through a dedicated environment variable within the Cluster Operator deployment. The watched namespaces feature is disabled by default.

Workarounds

A possible workaround for this issue is about using a policy agent like Kyverno or OPA to prevent the usage of the watchedNamespace at configuration level within the Kafka custom resource.

AnalysisAI

Cross-namespace privilege escalation in Strimzi Kafka Operator versions up to 1.0.0 allows tenants with namespace-scoped Kafka custom resource creation rights to read and write Secrets in any namespace where the Cluster Operator has been granted permissions. By abusing the documented watchedNamespace field within Kafka.spec.entityOperator, an attacker mints a token for the entity operator ServiceAccount in their own namespace and gains full CRUD on Secrets in the target namespace. No public exploit identified at time of analysis, but the attack is mechanically straightforward in any multi-tenant Strimzi deployment.

Technical ContextAI

Strimzi is the upstream operator that manages Apache Kafka on Kubernetes, packaged as the Maven artifact io.strimzi:strimzi. The Cluster Operator reconciles Kafka custom resources and, when entityOperator.topicOperator.watchedNamespace or entityOperator.userOperator.watchedNamespace is set, provisions a Role granting full CRUD on Secrets in the watched namespace plus a RoleBinding to the entity operator ServiceAccount that lives in the Kafka cluster's namespace. CWE-269 (Improper Privilege Management) applies because the operator follows the user-supplied watchedNamespace field without an additional authorization check confirming the requestor actually owns or is entitled to act on that namespace, conflating the operator's cluster-wide permissions with the tenant's legitimate scope. The vulnerability is therefore not a code-injection or auth-bypass bug but a design flaw in how cross-namespace Role provisioning is authorized.

RemediationAI

Vendor-released patch: upgrade Strimzi to 1.0.1 or 1.1.0, per advisory GHSA-mw9r-p8xp-wx96 (https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-mw9r-p8xp-wx96); these versions introduce a dedicated Cluster Operator environment variable that gates the watched-namespace feature and disables it by default, so after upgrading verify you do not need to explicitly re-enable the feature for any legitimate consumers. If immediate upgrade is not possible, the vendor-recommended workaround is to deploy a policy agent such as Kyverno or OPA Gatekeeper with an admission policy that rejects Kafka custom resources whose spec.entityOperator.topicOperator.watchedNamespace or spec.entityOperator.userOperator.watchedNamespace differs from the namespace of the Kafka resource itself; the trade-off is that any legitimate cross-namespace entity-operator topology will also be blocked until exceptions are written. Additionally consider tightening the Cluster Operator's cluster-wide RoleBindings so it only has rights into namespaces that truly need managed Kafka, which shrinks the blast radius of any future bypass.