Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

Published September 10, 2026 CVE-2026-80352

Apache Camel K can let an authorized custom resource author inject Kubernetes objects into a cluster. Those objects may use the operator's privileges, potentially enabling unauthorized resource creation.

Severity
CriticalCVSS 3.1 · 9.8
Fix
Fixed in 2.9.3
Affected versions
2.0.0 to before 2.9.3; 2.10.1 to before 2.10.2
Weakness
CWE-94Code Injection
Exploit likelihood
0.33% in 30 daysEPSS, higher than 26% of known flaws
Affects
Apache Camel K
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: total
EU ID
EUVD-2026-75290ENISA vulnerability database

How it works

  • An authorized custom resource author places specially structured YAML in the resource configuration.
  • Camel K can then inject arbitrary Kubernetes objects from that content.
  • Those objects may be created with the operator's privileges.
  • The supplied excerpts do not specify the exact objects or final outcome in each deployment.

What to do

Check the Apache Camel K version installed in each cluster and compare it with the Apache advisory.

Upgrade Apache Camel K to 2.9.3, 2.10.2, or 2.11.0, which fix this issue.

Technical details

CVE-2026-80352 affects Camel K custom resource processing. An authorized custom resource author can inject arbitrary Kubernetes objects, which Camel K may create with the operator's privileges.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source