Unintended Proxy or Intermediary ('Confused Deputy') Affecting io.strimzi:strimzi package, versions [,1.0.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Unintended Proxy or Intermediary ('Confused Deputy') vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-IOSTRIMZI-17732762
- published30 Jun 2026
- disclosed18 Jun 2026
- creditUnknown
Introduced: 18 Jun 2026
CVE-2026-55225 (opens in a new tab)How to fix?
Upgrade io.strimzi:strimzi to version 1.0.1 or higher.
Overview
Affected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via the Kafka.spec.entityOperator process. An attacker can gain unauthorized access to read and modify secrets in other namespaces by crafting a custom resource with the watchedNamespace field set to a target namespace and minting a token for the ServiceAccount in the attacker's namespace. This allows access to any namespace for which the Cluster Operator has been granted permissions through RoleBindings.
Workaround
This vulnerability can be mitigated by using a policy agent such as Kyverno or OPA to prevent the usage of the watchedNamespace field at the configuration level within the Kafka custom resource.