High [CVE-2026-55225] Cross-namespace privilege escalation via Kafka.spec.entityOperator.watchedNamespace in Strimzi
This high-severity Red Hat Linux advisory covers CVE-2026-55225 affecting Streams for Apache Kafka 3.2.1, streams for Apache Kafka 2.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations.
In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace.
The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. This issue is fixed in versions 1.0.1 and 1.1.0.
When the Strimzi cluster operator is deployed with watchAnyNamespace=true (or a multi-namespace list), any namespace editor can set Kafka.spec.entityOperator.userOperator.watchedNamespace (or topicOperator.watchedNamespace) to an arbitrary namespace.
The cluster operator then creates a Role granting full CRUD on Secrets in the target namespace and a RoleBinding pointing to a ServiceAccount in the attacker's namespace — effectively granting cluster-admin-equivalent access via kube-system secret exfiltration.
The RBAC objects created cross-namespace have their ownerReferences deliberately stripped, making the privilege grant persistent even after the Kafka CR or attacker namespace is deleted.
- 1.0.0
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
- 1.0.1
- 1.1.0
- cluster-operator
- RHSA-2026:54435
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
Mitigation checklist
- For users who cannot upgrade immediately, deploy a Kubernetes admission policy agent (such as Kyverno or OPA Gatekeeper) to block or restrict the use of the `watchedNamespace` field in Kafka custom resources (`Kafka.spec.entityOperator.userOperator.watchedNamespace` and `Kafka.spec.entityOperator.topicOperator.watchedNamespace`). Additionally, audit existing Kafka custom resources for unexpected `watchedNamespace` configurations and review RoleBindings in sensitive namespaces.
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.