AI analysis
Apache Camel K contains an eval injection flaw (CWE-95) in its handling of dynamically evaluated Maven configuration. When tenant-controlled Maven repository content is processed, it is evaluated inside the Camel K operator pod without proper neutralization of directives, allowing repository content to steer code execution. A tenant can potentially execute arbitrary code with the privileges of the operator, which in multi-tenant clusters may enable cross-tenant compromise because the operator typically manages integrations across namespaces. Users running Apache Camel K from 2.0.0 before 2.9.3, and from 2.10.1 before 2.10.2, are affected, especially multi-tenant deployments where tenants can influence Maven repository settings. No public proof-of-concept or in-the-wild exploitation is known, the issue is not in CISA KEV, and a CVSS score has not yet been assigned.
What to do: Upgrade to Apache Camel K 2.9.3, 2.10.2, or 2.11.0, which fix the issue. Until patched, restrict or review tenants' ability to customize Maven repositories and settings, and review the operator pod's RBAC permissions to assess the blast radius of a tenant-triggered code execution. Multi-tenant operators should treat this as priority patching since tenant-supplied configuration reaches operator-level execution.
Affected
| Apache Camel K | from 2.0.0 before 2.9.3 |
| Apache Camel K | from 2.10.1 before 2.10.2 |
Estimated exposure
nichelikely only thousands of clusters (specialized Apache Kubernetes operator; no public install statistics available) — Camel K is a niche Kubernetes operator for running Camel integrations, deployed mainly in enterprise cloud-native integration stacks, with no public active-install counts, so exposure is plausibly limited to a low-thousands order of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.