CVE-2026-80354: Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace
Apache Camel K CVE-2026-80354 lets tenants reference secrets by name in the operator namespace, exposing other tenants' secrets.
Apache disclosed a moderate authorization bypass (CVE-2026-80354) in Apache Camel K's Builder trait, where mavenProfiles ValueSources resolve tenant-named secrets in the operator namespace. A tenant can reference secrets by name, potentially exposing secrets belonging to other tenants or the operator. Affected versions are 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2; fixes are available in 2.9.3 and 2.10.2.
- Authorization bypass via user-controlled key in custom resource resolution.
- Tenants can resolve secrets in the operator namespace across tenant boundaries.
- Fixed in Apache Camel K 2.9.3 and 2.10.2; rated moderate severity.
- CVEs
- CVE-2026-80354
- Vendors
- Apache
- Products
- Apache Camel K
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80354 | Cross-Tenant Secret Exposure via Authorization Bypass in Apache Camel K | 8.1 | — |
From the original article
Posted by Pasquale Congiusti on Sep 10 Severity: moderate Affected versions: - Apache Camel K (apache/camel-k) 2. 0. 0 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.