CVE-2025-66623

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The issue is fixed in Strimzi 0.49.1.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/strimzi/strimzi-kafka-operator/commit/c8a14935e99c91eb0dd865431f46515da9f82ccc	Patch
https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-xrhh-hx36-485q	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:strimzi:*:*:*:*:*:*:*:*

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Strimzi proporciona una forma de ejecutar un clúster de Apache Kafka en Kubernetes u OpenShift en varias configuraciones de despliegue. Desde 0.47.0 y versiones anteriores a 0.49.1, en algunas situaciones, Strimzi crea un Role de Kubernetes incorrecto que otorga a los operandos de Apache Kafka Connect y Apache Kafka MirrorMaker 2 el acceso GET a todos los Secrets de Kubernetes que existen en el namespace de Kubernetes dado. El problema está solucionado en Strimzi 0.49.1.

Information

Published : 2025-12-05 19:15

Updated : 2026-09-25 23:10

NVD link : CVE-2025-66623

Mitre link : CVE-2025-66623

CVE.ORG link : CVE-2025-66623

JSON object : View

Products Affected

linuxfoundation

strimzi

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-863

Incorrect Authorization

{"id": "CVE-2025-66623", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66623", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T20:10:15.727387Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "strimzi", "product": "strimzi-kafka-operator", "versions": [{"status": "affected", "version": ">= 0.47.0, < 0.49.1"}]}]}], "published": "2025-12-05T19:15:52.910", "references": [{"url": "https://github.com/strimzi/strimzi-kafka-operator/commit/c8a14935e99c91eb0dd865431f46515da9f82ccc", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-xrhh-hx36-485q", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The issue is fixed in Strimzi 0.49.1."}, {"lang": "es", "value": "Strimzi proporciona una forma de ejecutar un cl\u00faster de Apache Kafka en Kubernetes u OpenShift en varias configuraciones de despliegue. Desde 0.47.0 y versiones anteriores a 0.49.1, en algunas situaciones, Strimzi crea un Role de Kubernetes incorrecto que otorga a los operandos de Apache Kafka Connect y Apache Kafka MirrorMaker 2 el acceso GET a todos los Secrets de Kubernetes que existen en el namespace de Kubernetes dado. El problema est\u00e1 solucionado en Strimzi 0.49.1."}], "lastModified": "2026-09-25T23:10:00.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:strimzi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55FC7CB9-D19F-4293-ACE7-38285D1112D5", "versionEndExcluding": "0.49.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}