The vulnerability allows any user with namespace editor privileges to assign a Kafka cluster operator’s entityOperator.watchedNamespace to an arbitrary namespace. This causes the operator to create a Role that permits full CRUD on Secrets in the target namespace and a RoleBinding that points to the attacker's ServiceAccount. The resulting RBAC objects lack ownerReferences, so the elevated privileges persist even after the Kafka custom resource or the attacker’s namespace is deleted. The flaw results in arbitrary manipulation of Secrets, leading to possible data exfiltration and full control of the cluster.

All Strimzi cluster operator installations that enable the watched‑namespace feature, including any version prior to 1.0.1 or 1.1.0 where the feature is disabled by default.

The CVSS score of 8.0 classifies this as a high‑severity vulnerability. While an EPSS score is not reported, the exposure is significant due to the wide‑scope impact on Secrets and the persistence of the malicious RBAC objects. The feature is not listed in the CISA KEV catalog, but the potential for severe compromise advises prompt remediation.