GHSA-r427-j2h7-wv3m
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.strimzi:strimzi | < 1.0.1 | 1.0.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
When only the Topic or only the User operators are deployed as part of the Entity Operator in the `Kafka` custom resource, the RBAC rights are not following the principle of least-privilege and the Entity Operator ServiceAccount still has access rights corresponding to both operators. That might allow the ServiceAccount to access `KafkaUser` custom resources and Secrets when the User operator is not deployed and access `KafkaTopic` custom resources when the Topic operator is not deployed.
### Patches
The issue is fixed in Strimzi 1.0.1 and 1.1.0.
### Workarounds
There is no workaround for this issue.
References
External links from the advisory. They lead to third-party sites.