ZeroHour

CVE-2026-80351

niche1

Eval injection in Apache Camel K lets tenants run code with operator privileges

CVSS 3.1
9.8 critical
EPSS
Published
()
Modified
AI analysis

Apache Camel K contains an eval injection flaw (CWE-95) in its handling of dynamically evaluated Maven configuration. When tenant-controlled Maven repository content is processed, it is evaluated inside the Camel K operator pod without proper neutralization of directives, allowing repository content to steer code execution. A tenant can potentially execute arbitrary code with the privileges of the operator, which in multi-tenant clusters may enable cross-tenant compromise because the operator typically manages integrations across namespaces. Users running Apache Camel K from 2.0.0 before 2.9.3, and from 2.10.1 before 2.10.2, are affected, especially multi-tenant deployments where tenants can influence Maven repository settings. No public proof-of-concept or in-the-wild exploitation is known, the issue is not in CISA KEV, and a CVSS score has not yet been assigned.

What to do: Upgrade to Apache Camel K 2.9.3, 2.10.2, or 2.11.0, which fix the issue. Until patched, restrict or review tenants' ability to customize Maven repositories and settings, and review the operator pod's RBAC permissions to assess the blast radius of a tenant-triggered code execution. Multi-tenant operators should treat this as priority patching since tenant-supplied configuration reaches operator-level execution.

Affected
Apache Camel Kfrom 2.0.0 before 2.9.3
Apache Camel Kfrom 2.10.1 before 2.10.2
Estimated exposure
nichelikely only thousands of clusters (specialized Apache Kubernetes operator; no public install statistics available) — Camel K is a niche Kubernetes operator for running Camel integrations, deployed mainly in enterprise cloud-native integration stacks, with no public active-install counts, so exposure is plausibly limited to a low-thousands order of…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

Vendors
apache
Products
camel
Weakness
CWE-95
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the news

CVE-2026-80351: Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Apache Camel K CVE-2026-80351 lets tenant-controlled Maven repository content execute code inside the operator pod; fixed in 2.9.3/2.10.2.

Apache disclosed a critical eval injection vulnerability (CVE-2026-80351) in Apache Camel K, where improperly neutralized directives in dynamically evaluated Maven configuration let tenant-controlled repository content reach Maven execution inside the operator pod. This can allow tenant-controlled content to influence code execution in the operator context. Affected versions are 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2; fixes are available in 2.9.3 and 2.10.2.

oss-security · 5d agoVulnerabilityCVE-2026-803512