CyberRota Analysis
AI-GeneratedStrimzi versions 1.0.0 and earlier have a vulnerability where deploying only the Topic or User Operator can leave the Entity Operator ServiceAccount with excessive RBAC permissions, potentially allowing unauthorized access to KafkaUser or KafkaTopic custom resources and associated Secrets. This could lead to data exposure or unauthorized modifications within an Apache Kafka cluster. Organizations using Strimzi for Kafka on Kubernetes or OpenShift should prioritize upgrading to versions 1.0.1 or 1.1.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0.