High · published December 6, 2025
⚡ A misconfigured Kubernetes Role is letting Apache Kafka Connect and MirrorMaker 2 snoop on ALL Secrets in your namespace! 🔍 Think of it like a hotel concierge who accidentally has the master key to every room instead of just the ones they’re supposed to clean. This oversight means they can peek into any guest's belongings, which is a major breach of privacy! If an attacker exploits this vulnerability, they could gain access to sensitive credentials and configuration data across your entire Kubernetes namespace. This could lead to unauthorized access to your applications and services, creating a dangerously wide attack surface for data breaches!
Think of it like a hotel concierge who accidentally has the master key to every room instead of just the ones they’re supposed to clean. This oversight means they can peek into any guest's belongings, which is a major breach of privacy! In Strimzi versions 0.47.0 through 0.49.0, an incorrect Kubernetes Role grants GET access to all secrets, allowing unauthorized access to sensitive data within the namespace.
If an attacker exploits this vulnerability, they could gain access to sensitive credentials and configuration data across your entire Kubernetes namespace. This could lead to unauthorized access to your applications and services, creating a dangerously wide attack surface for data breaches! To protect your environment, upgrade Strimzi to version 0.49.1 or later immediately! Additionally, review your Kubernetes Role configurations to ensure they adhere to the principle of least privilege. 🔒 You've got this! Stay vigilant and keep your systems secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| linuxfoundation/strimzi | < 0.49.1 | 0.49.1 |