CVE-2025-66623

Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

State: Published
Severity: 7.4 High
Published: Dec 5, 2025
Updated: Dec 5, 2025
Reserved: Dec 5, 2025

Read the record on cve.org

Description

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The issue is fixed in Strimzi 0.49.1.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
strimzi-kafka-operatorstrimzi	>= 0.47.0, < 0.49.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.