Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace

Published September 10, 2026 CVE-2026-80354

Apache Camel K can expose secrets from its operator namespace to a tenant that references them by name. The issue affects specific older releases and has fixed versions.

Severity
HighCVSS 3.1 · 8.1
Fix
Fixed in 2.9.3
Affected versions
2.0.0 to before 2.9.3; 2.10.1 to before 2.10.2
Weakness
CWE-639Authorization Bypass Through User-Controlled Key
Exploit likelihood
0.22% in 30 daysEPSS, higher than 13% of known flaws
Affects
Apache Camel K
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75292ENISA vulnerability database

How it works

  • A tenant can reference a secret by name during custom resource processing.
  • Apache Camel K may resolve that name in the operator namespace instead of limiting access correctly.
  • This can expose secrets belonging to other tenants or operator components.

What to do

Compare your Apache Camel K version with the affected ranges in the Apache advisory. Versions 2.0.0 through before 2.9.3 and 2.10.1 through before 2.10.2 are affected.

Upgrade Apache Camel K to version 2.9.3, 2.10.2, or 2.11.0, which fixes this issue.

Technical details

CVE-2026-80354 is an authorization bypass in Apache Camel K custom resource resolution. A tenant-controlled secret name can resolve against the operator namespace, potentially exposing secrets belonging to other tenants or operator components.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source