The vulnerability in Strimzi Kafka Operator causes any certificate in a multi‑CA chain supplied to Kafka Connect or Kafka MirrorMaker 2 to be treated as a trust anchor. Consequently, a broker presenting a server certificate signed by any of the CAs in the chain—rather than only the final CA—will be accepted, potentially allowing unauthorized connections or man‑in‑the‑middle attacks. This flaw is related to improper verification of cryptographic signatures (CWE‑295) and improper trust validation (CWE‑296).

Strimzi Kafka Operator versions 0.47.0 through 0.49.x are affected. The issue arises when these versions are deployed with a multi‑CA chain in the trusted certificates configuration for Kafka Connect or MirrorMaker 2. Upgrading to Strimzi 0.50.1 or later removes the flaw.

The CVSS score is 5.9, indicating moderate severity, and the EPSS score is below 1%, suggesting a low likelihood of exploitation. The vulnerability is not currently listed in CISA's KEV catalog. The likely attack vector involves an adversary controlling a Kafka broker and presenting a certificate signed by one of the unintended CAs; the affected Connect or MirrorMaker instance will accept the connection as valid, allowing potential impersonation or data leakage. While the attack requires network access to the Kafka Connect or MirrorMaker service, the low exploitation probability reduces immediate risk, but the impact of a successful compromise could be significant for confidentiality and integrity of the data stream.