STRIMZI incorrect access control
Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka ACL if it exists), and potentially steal Kafka SASL credentials, by querying the MirrorMaker Kafka REST API.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.strimzi:strimzi | <= 0.41.0 | no fix |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L- Weakness (CWE)
CWE-306, CWE-400- Platform
- Java / Kotlin (Maven)
- Package
io.strimzi:strimzi- Disclosed
- 17.06.2024
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-q2xx-f8r3-9mg5 - CC BY 4.0
Vulnerability history: io.strimzi:strimzi
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 06.2024 06.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Medium 1
Disclosures per year
- 2024: 1
- 2025: 1
- 2026: 2
-
STRIMZI incorrect access control this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.