CVE-2025-66623

Katalog CVE

CVSS 7.4 · High EPSS 0,17%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada linuxfoundation strimzi. Skor CVSS 3.1 7.4 (High) menurut github.com.

Deskripsi (NVD)

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The issue is fixed in Strimzi 0.49.1.

Rincian

Terbit di NVD

5 Desember 2025

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

7.4 (High), sumber github.com
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/strimzi/strimzi-kafka-operator/security/advisories/GHSA-xrhh-hx36-485q advisory vendor
• https://github.com/strimzi/strimzi-kafka-operator/commit/c8a14935e99c91eb0dd865431f46515da9f82ccc patch