Apache Camel K: three tenant-isolation flaws (CVE-2026-80351, CVE-2026-80352, CVE-2026-80354) fixed in 2.9.3/2.10.2
Apache disclosed three Apache Camel K vulnerabilities on 2026-09-10 — two critical (eval injection letting tenant Maven content execute in the operator pod; Master trait serviceAccountName YAML injection applying arbitrary Kubernetes objects) and one moderate…
On 2026-09-10, Apache disclosed via oss-security three Apache Camel K vulnerabilities, all affecting versions 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2, with fixes available in 2.9.3 and 2.10.2. CVE-2026-80351, rated critical, is an eval injection: improperly neutralized directives in dynamically evaluated Maven configuration allow tenant-controlled Maven repository content to reach Maven execution inside the operator pod, which can allow tenant-controlled content to influence code execution in the operator context. CVE-2026-80352, rated critical, is a YAML injection (improper control of code generation) in the Master trait serviceAccountName setting: an authorized custom resource author can inject arbitrary Kubernetes objects, potentially enabling unauthorized resource manipulation; exploitation requires an authorized CR author within the cluster. CVE-2026-80354, rated moderate, is an authorization bypass via a user-controlled key in custom resource resolution: the Builder trait's mavenProfiles ValueSources resolve tenant-named secrets in the operator namespace, so a tenant can reference secrets by name and potentially expose secrets belonging to other tenants or the operator. All three issues break tenant isolation in multi-tenant Camel K deployments, with two of the three enabling code execution or arbitrary object application in or from the operator context. The three reports state identical affected and fixed version ranges; no discrepancies were found between them.
- Affected versions for all three CVEs: Apache Camel K 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2.
- Fixed versions for all three CVEs: Apache Camel K 2.9.3 and 2.10.2.
- CVE-2026-80351 (critical): eval injection — improperly neutralized directives in dynamically evaluated Maven configuration let tenant-controlled Maven repository content reach Maven execution inside the operator pod, potentially…
- CVE-2026-80352 (critical): YAML injection (improper control of code generation) in the Master trait serviceAccountName — an authorized custom resource author can inject arbitrary Kubernetes objects, enabling potential unauthorized resource…
- CVE-2026-80354 (moderate): authorization bypass via user-controlled key in custom resource resolution — Builder trait mavenProfiles ValueSources resolve tenant-named secrets in the operator namespace, potentially exposing secrets of other…
- Disclosed by Apache via oss-security on 2026-09-10; all three flaws undermine tenant isolation in multi-tenant Camel K deployments.
- All three reports give identical affected/fixed version ranges; no discrepancies between sources.
Coverage timelineoldest first · each row is one article
- · 5d agoCVE-2026-80351: Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod
oss-security· 35
Apache Camel K CVE-2026-80351 lets tenant-controlled Maven repository content execute code inside the operator pod; fixed in 2.9.3/2.10.2.
- · 5d agoCVE-2026-80352: Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
Apache Camel K CVE-2026-80352 lets CR authors inject arbitrary Kubernetes objects via Master trait serviceAccountName YAML injection.
- · 5d agoCVE-2026-80354: Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace
Apache Camel K CVE-2026-80354 lets tenants reference secrets by name in the operator namespace, exposing other tenants' secrets.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-80351 | Eval injection in Apache Camel K lets tenants run code with operator privileges Apache Camel K contains an eval injection flaw (CWE-95) in its handling of dynamically evaluated Maven configuration. When tenant-controlled Maven repository content is processed, it is evaluated inside the Camel K operator pod without proper neutralization of directives, allowing repository content to steer code execution. A tenant can potentially execute arbitrary code with the privileges of the operator, which in multi-tenant clusters may enable cross-tenant compromise because the operator typically manages integrations across namespaces. Users running Apache Camel K from 2.0.0 before 2.9.3, and from 2.10.1 before 2.10.2, are affected, especially multi-tenant deployments where tenants can influence Maven repository settings. No public proof-of-concept or in-the-wild exploitation is known, the issue is not in CISA KEV, and a CVSS score has not yet been assigned. Do: Upgrade to Apache Camel K 2.9.3, 2.10.2, or 2.11.0, which fix the issue. Until patched, restrict or review tenants' ability to customize Maven repositories and settings, and review the operator pod's RBAC permissions to assess the blast radius of a tenant-triggered code execution. Multi-tenant operators should treat this as priority patching since tenant-supplied configuration reaches operator-level execution. | 9.8 group max | — |
| nichelikely only thousands of clusters (specialized Apache Kubernetes operator; no public install statistics available) |