Two high-severity Apache Camel Karavan flaws disclosed

Apache Camel Karavan before 4.22.1 has two CVSS 8.8 flaws: Git path traversal and unrestricted Kubernetes resource apply.

Apache disclosed two high-severity flaws in Apache Camel Karavan, both scored CVSS 3.1 8.8 and both fixed in versions before 4.22.1, with no active exploitation reported. CVE-2026-103412 is a path traversal affecting 3.18.0 before 4.22.1: a project file name supplied through the project file API is used verbatim as a path segment when the project is written into the Git working copy. An attacker needs low privileges and no user interaction. CVE-2026-103413 is improper input validation affecting 4.0.0 before 4.22.1: when a deployment starts, Karavan unmarshals a project's kubernetes.yaml and applies every contained resource to the cluster without restricting kinds or rejecting security-sensitive pods. That flaw is network-reachable with low complexity and low privileges, and has high impact on confidentiality, integrity, and availability. The two reports do not disagree on scores, affected ranges, or lack of known exploitation.