Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-r427-j2h7-wv3m

Опубликовано: 18 июн. 2026
Источник: github
Github: Прошло ревью
CVSS3: 5.4

Описание

Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

Impact

When only the Topic or only the User operators are deployed as part of the Entity Operator in the Kafka custom resource, the RBAC rights are not following the principle of least-privilege and the Entity Operator ServiceAccount still has access rights corresponding to both operators. That might allow the ServiceAccount to access KafkaUser custom resources and Secrets when the User operator is not deployed and access KafkaTopic custom resources when the Topic operator is not deployed.

Patches

The issue is fixed in Strimzi 1.0.1 and 1.1.0.

Workarounds

There is no workaround for this issue.

Пакеты

Наименование

io.strimzi:strimzi

maven
Затронутые версииВерсия исправления

<= 1.0.0

1.0.1

5.4 Medium

CVSS3

Дефекты

CWE-269
CWE-272

Связанные уязвимости

CVSS3: 5.4
redhat
около 2 месяцев назад

When deploying only the Topic Operator or only the User Operator via the Kafka custom resource, the Entity Operator's ServiceAccount retains RBAC rights for both operators rather than scoping permissions to the one actually deployed. This allows the ServiceAccount to access KafkaUser custom resources and Secrets even when the User Operator is not deployed, or access KafkaTopic custom resources when the Topic Operator is not deployed, violating the principle of least privilege. There is no workaround for this issue. Fixed in Strimzi 1.0.1 and 1.1.0.

5.4 Medium

CVSS3

Дефекты

CWE-269
CWE-272