CVE-2026-80351

Apache Camel K contains an eval injection flaw (CWE-95) in its handling of dynamically evaluated Maven configuration. When tenant-controlled Maven repository content is processed, it is evaluated inside the Camel K operator pod without proper neutralization of directives, allowing repository content to steer code execution. A tenant can potentially execute arbitrary code with the privileges of the operator, which in multi-tenant clusters may enable cross-tenant compromise because the operator typically manages integrations across namespaces. Users running Apache Camel K from 2.0.0 before 2.9.3, and from 2.10.1 before 2.10.2, are affected, especially multi-tenant deployments where tenants can influence Maven repository settings. No public proof-of-concept or in-the-wild exploitation is known, the issue is not in CISA KEV, and a CVSS score has not yet been assigned.

What to do: Upgrade to Apache Camel K 2.9.3, 2.10.2, or 2.11.0, which fix the issue. Until patched, restrict or review tenants' ability to customize Maven repositories and settings, and review the operator pod's RBAC permissions to assess the blast radius of a tenant-triggered code execution. Multi-tenant operators should treat this as priority patching since tenant-supplied configuration reaches operator-level execution.