CVE-2025-66623
HIGHStrimzi 0.47.0-0.49.0 - Incorrect Authorization via Kubernetes Role
Title source: llmDescription
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The issue is fixed in Strimzi 0.49.1.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-xrhh-hx36-485q
Scores
CVSS v3
7.4
EPSS
0.0002
EPSS Percentile
6.8%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-863
CWE-200
Status
published
Products (2)
io.strimzi/strimzi
0.47.0 - 0.49.1Maven
linuxfoundation/strimzi
< 0.49.1
Published
Dec 05, 2025
Tracked Since
Feb 18, 2026