CVE-2026-80351: Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod
Apache Camel K CVE-2026-80351 lets tenant-controlled Maven repository content execute code inside the operator pod; fixed in 2.9.3/2.10.2.
Apache disclosed a critical eval injection vulnerability (CVE-2026-80351) in Apache Camel K, where improperly neutralized directives in dynamically evaluated Maven configuration let tenant-controlled repository content reach Maven execution inside the operator pod. This can allow tenant-controlled content to influence code execution in the operator context. Affected versions are 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2; fixes are available in 2.9.3 and 2.10.2.
- Tenant-controlled Maven repository configuration is evaluated inside the operator pod.
- Eval injection may enable code execution in the operator context.
- Rated critical by Apache; fixed in Camel K 2.9.3 and 2.10.2.
- CVEs
- CVE-2026-80351
- Vendors
- Apache
- Products
- Apache Camel K
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80351 | Eval injection in Apache Camel K lets tenants run code with operator privileges | 9.8 | — |
From the original article
Posted by Pasquale Congiusti on Sep 10 Severity: critical Affected versions: - Apache Camel K (apache/camel-k) 2. 0. 0 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.