CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
Apache Camel Karavan CVE-2026-103413 applies unrestricted Kubernetes resources from a project's kubernetes.yaml.
Apache disclosed CVE-2026-103413, an improper input validation flaw in Apache Camel Karavan rated CVSS 3.1 8.8. Versions 4.0.0 before 4.22.1 unmarshal a project's kubernetes.yaml when a deployment starts and apply every contained resource to the cluster without restricting kinds or rejecting security-sensitive pods. The vector is network-reachable with low complexity and low privileges, and high impact on confidentiality, integrity, and availability. No active exploitation is reported.
- CVSS 3.1 score is 8.8 with network access and low privileges.
- Karavan 4.0.0 before 4.22.1 is affected.
- A project's kubernetes.yaml is applied without restricting resource kinds.
- The flaw can include security-sensitive pod resources.
- The disclosure does not report exploitation in the wild.
- CVEs
- CVE-2026-103413
- Vendors
- Apache
- Products
- Apache Camel Karavan
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103413 | Input validation flaw in Apache Camel Karavan Kubernetes apply | 8.8 | — |
From the original article
Posted by Andrea Cosentino on Oct 09 Severity: CVSS 3. 1: 8. 8 (high) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.