Vulnerabilities

Apache Camel K contains a YAML injection flaw (CWE-94, improper control of code generation) in its handling of custom resource (CR) configuration, specifically exposed via the Master trait's serviceAccountName field. An authenticated user who is authorized to author Camel K custom resources can embed crafted YAML that causes the operator to apply arbitrary Kubernetes objects. Because the injected objects are created with the privileges of the Camel K operator's service account, an attacker can gain unauthorized creation of cluster resources, potentially enabling privilege escalation or lateral movement within the cluster. Users running Apache Camel K 2.0.0 through 2.9.2 or 2.10.1 are affected; fixed releases are 2.9.3, 2.10.2, and 2.11.0. No public proof-of-concept or in-the-wild exploitation is known, and no CVSS score has been assigned yet.

Do: Upgrade to Apache Camel K 2.9.3, 2.10.2, or 2.11.0. As interim mitigation, limit which users and service accounts can create or modify Camel K custom resources, and audit the cluster for unexpected Kubernetes objects created with the operator's service account, paying attention to Master-trait configuration fields such as serviceAccountName.

Apache FreeMarker is vulnerable to path traversal (CWE-23) in its template loading mechanism when the localized lookup configuration setting is enabled, which is the default. The flaw is triggered if an application allows an attacker to supply an arbitrary, malformed locale identifier to FreeMarker; the malformed locale can cause template loading to traverse outside the intended path. What an attacker gains depends on configuration: files that can be loaded remain restricted by the configured TemplateLoader — FileTemplateLoader already prevents traversal outside its baseDir, and loaders wrapping a class loader or web application context can only reach resources those mechanisms expose — but other loader configurations may allow access outside the designated base directory, potentially enabling unintended file or resource disclosure. Any application embedding Apache FreeMarker versions 2.2.0 through 2.3.34 that passes attacker-controlled locale values into template loading is affected, including downstream products that bundle the library. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

Do: Upgrade to Apache FreeMarker 2.3.35; as a mitigation on earlier versions, disable the localized lookup setting. Audit applications for code paths where user-supplied locale identifiers reach FreeMarker template loading, and review which TemplateLoader is configured to assess whether files outside the intended base directory can be reached.

CVE-2026-57967 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache Artemis and Apache ActiveMQ Artemis message brokers. An unauthenticated remote attacker who can reach the broker's CORE acceptor can send a crafted SESSION_REATTACH packet to steal an already-established session. By doing so, the attacker assumes ongoing execution of the previously authenticated session, effectively impersonating a legitimate connected client. All versions from 1.0.0 through 2.44.0 (Apache ActiveMQ Artemis) and 2.50.0 through 2.56.0 (Apache Artemis) are affected, and version 2.57.0 fixes the issue. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

Do: Upgrade to Apache ActiveMQ Artemis 2.57.0, which fixes the issue for both product lines. Until upgraded, restrict network access to the broker's CORE acceptor port (commonly 61616) so only trusted networks and clients can reach it, and review broker logs for unexpected or unexplained session reattachment activity.