YAML injection in Apache Camel K lets CR authors create objects with operator privileges
AI analysis
Apache Camel K contains a YAML injection flaw (CWE-94, improper control of code generation) in its handling of custom resource (CR) configuration, specifically exposed via the Master trait's serviceAccountName field. An authenticated user who is authorized to author Camel K custom resources can embed crafted YAML that causes the operator to apply arbitrary Kubernetes objects. Because the injected objects are created with the privileges of the Camel K operator's service account, an attacker can gain unauthorized creation of cluster resources, potentially enabling privilege escalation or lateral movement within the cluster. Users running Apache Camel K 2.0.0 through 2.9.2 or 2.10.1 are affected; fixed releases are 2.9.3, 2.10.2, and 2.11.0. No public proof-of-concept or in-the-wild exploitation is known, and no CVSS score has been assigned yet.
What to do: Upgrade to Apache Camel K 2.9.3, 2.10.2, or 2.11.0. As interim mitigation, limit which users and service accounts can create or modify Camel K custom resources, and audit the cluster for unexpected Kubernetes objects created with the operator's service account, paying attention to Master-trait configuration fields such as serviceAccountName.
Affected
| Apache Camel K | >= 2.0.0 and < 2.9.3 (fixed in 2.9.3; also fixed in 2.11.0) |
| Apache Camel K | >= 2.10.1 and < 2.10.2 (fixed in 2.10.2; also fixed in 2.11.0) |
Estimated exposure
nichelikely at most low thousands of Kubernetes/OpenShift clusters running Camel K; no public install counts available — No public adoption metrics exist for this Kubernetes operator; Camel K is a niche integration-framework tool typically deployed by enterprises running Apache Camel workloads on Kubernetes/OpenShift, suggesting at most a few thousand…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.