CVE-2026-103413

Apache Camel Karavan 4.0.0 before 4.22.1 fails to validate a project's kubernetes.yaml when a deployment is started. It unmarshals the file and applies every resource it contains, without limiting resource kinds, rejecting security-sensitive pod options, or pinning the target namespace. Any authenticated user, of any role, can therefore cause Karavan to create arbitrary Kubernetes resources within the reach of its service account, including pods that request hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation, or added capabilities. Impact is high for confidentiality, integrity, and availability on clusters where that service account is powerful (CVSS 8.8). The issue is not listed in CISA KEV and no public proof-of-concept is known; upgrading to 4.22.1 fixes it.

What to do: Upgrade Apache Camel Karavan to 4.22.1 or later. Until then, restrict the Karavan service account to the least privilege needed and limit who can start deployments. Review the cluster for resources Karavan may already have applied, especially pods using hostNetwork, hostPID, hostIPC, hostPath, host ports, privileged mode, privilege escalation, or extra capabilities, and remove anything unexpected.