Is CVE-2026-27133 actively exploited?

No active exploitation of CVE-2026-27133 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27133 be exploited remotely?

Yes. CVE-2026-27133 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-27133?

CVE-2026-27133 has a CVSS score of 5.9 (MEDIUM) and an EPSS exploitation probability of 0.03%.

HOME VULNERABILITIESCVE-2026-27133

MEDIUM

CVE-2026-27133

CWE-295Published: February 20, 2026· Updated: Feb 27, 2026

5.9

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.8th

Official Description

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA (Certificate Authority) certificates is used in the trusted certificates configuration of a Kafka Connect operand or of the target cluster in the Kafka MirrorMaker 2 operand, all of the certificates that are part of the CA chain will be trusted individually when connecting to the Apache Kafka cluster. Due to this error, the affected operand (Kafka Connect or Kafka MirrorMaker 2) might accept connections to Kafka brokers using server certificates signed by one of the other CAs in the CA chain and not just by the last CA in the chain. This issue is fixed in Strimzi 0.50.1.

NVD Source

Technical Analysis

CVE-2026-27133 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 5.9.