CVE-2026-80352: Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
Apache Camel K CVE-2026-80352 lets CR authors inject arbitrary Kubernetes objects via Master trait serviceAccountName YAML injection.
Apache disclosed a critical YAML injection vulnerability (CVE-2026-80352, improper control of code generation) in Apache Camel K's Master trait serviceAccountName setting. An authorized custom resource author can inject arbitrary Kubernetes objects, potentially enabling unauthorized resource manipulation. Affected versions are 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2; fixes are available in 2.9.3 and 2.10.2.
- YAML injection in Master trait serviceAccountName allows arbitrary object application.
- Exploitation requires an authorized CR author within the cluster.
- Rated critical by Apache; fixed in Camel K 2.9.3 and 2.10.2.
- CVEs
- CVE-2026-80352
- Vendors
- Apache
- Products
- Apache Camel K
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80352 | YAML injection in Apache Camel K lets CR authors create objects with operator privileges | 9.8 | — |
From the original article
Posted by Pasquale Congiusti on Sep 10 Severity: critical Affected versions: - Apache Camel K (apache/camel-k) 2. 0. 0 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.