Cyber Resilience

CVE-2026-27133

Crypto Weakness in Linuxfoundation Strimzi 0.47.0 – 0.50.1

Published
20 February 2026
Modified
27 February 2026
Patch / advisory
CVSS Score v3.1 5.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0018 8th percentile
Risk Priority 40 floored blend · peak EPSS

Summary

CVE-2026-27133 is a medium-severity Improper Certificate Validation (CWE-295) vulnerability in Linuxfoundation Strimzi. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-17 (Public Key Infrastructure Certificates) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA (Certificate Authority) certificates is used in the trusted certificates configuration…

more

of a Kafka Connect operand or of the target cluster in the Kafka MirrorMaker 2 operand, all of the certificates that are part of the CA chain will be trusted individually when connecting to the Apache Kafka cluster. Due to this error, the affected operand (Kafka Connect or Kafka MirrorMaker 2) might accept connections to Kafka brokers using server certificates signed by one of the other CAs in the CA chain and not just by the last CA in the chain. This issue is fixed in Strimzi 0.50.1.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
Why these techniques?

Improper CA chain validation (CWE-295/296) directly enables acceptance of unauthorized broker certificates, facilitating adversary-in-the-middle position.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-66623Same product: Linuxfoundation Strimzi
CVE-2025-59347Same vendor: Linuxfoundation
CVE-2025-59410Same vendor: Linuxfoundation
CVE-2026-27134Same vendor: Linuxfoundation
CVE-2025-67499Same vendor: Linuxfoundation
CVE-2026-33248Same vendor: Linuxfoundation
CVE-2025-59353Same vendor: Linuxfoundation
CVE-2023-30840Same vendor: Linuxfoundation
CVE-2023-37031Same vendor: Linuxfoundation
CVE-2026-24932Shared CWE-295

Affected Assets

linuxfoundation
strimzi
0.47.0 — 0.50.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-8 Transmission Confidentiality and Integrity
  • SC-17 Public Key Infrastructure Certificates
  • IA-5 Authenticator Management
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 24 hardening rules · 5 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Requires cryptographic integrity protection for transmitted data, directly preventing acceptance of Kafka broker certificates validated against an incorrect CA chain.

prevent

Mandates proper issuance and validation of PKI certificates under an approved policy, addressing the chain-of-trust mishandling in Strimzi Kafka Connect/MirrorMaker 2 TLS connections.

prevent

Requires correct management and validation of certificate authenticators, mitigating the CWE-295/296 flaw that allows any CA in the chain to be trusted individually.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 mostly match
prevents

Certificate-based authentication of users/services/hardware directly depends on correct validation.

PR.DS-02 mostly match
prevents

Proper certificate validation is a core mechanism for protecting data-in-transit confidentiality and integrity.

PR.PS-06 mostly match
prevents

Secure development practices explicitly include implementing correct certificate validation logic.

ID.RA-09 partial match
prevents

Assessing authenticity/integrity of acquired software often relies on code-signing certificate validation.

PR.AA-04 partial match
prevents

Identity assertions conveyed via certificates require validation to be verified.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Mandates proper use of cryptography including certificate validation and trusted roots.

detects

Security testing can detect missing or incorrect certificate chain validation.

prevents

Secure coding standards address correct certificate chain validation.

degrades

Requires secure authentication mechanisms that rely on valid certificate chains.

none

Network security controls often enforce TLS certificate validation.

none

Secure network services depend on correct certificate chain validation.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (3 rules)
  • V-248574 YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization. via CWE-295
  • V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-295
  • V-248574 YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization. via CWE-296
RHEL 7 (3 rules)
  • V-204447 The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-295
  • V-204447 The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-296
  • V-204448 The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-296
RHEL 8 (3 rules)
  • V-230264 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-295
  • V-230265 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-295
  • V-230264 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-296

References