Apache Camel K: three tenant-isolation flaws (CVE-2026-80351, CVE-2026-80352, CVE-2026-80354) fixed in 2.9.3/2.10.2

Apache disclosed three Apache Camel K vulnerabilities on 2026-09-10 — two critical (eval injection letting tenant Maven content execute in the operator pod; Master trait serviceAccountName YAML injection applying arbitrary Kubernetes objects) and one moderate…

On 2026-09-10, Apache disclosed via oss-security three Apache Camel K vulnerabilities, all affecting versions 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2, with fixes available in 2.9.3 and 2.10.2. CVE-2026-80351, rated critical, is an eval injection: improperly neutralized directives in dynamically evaluated Maven configuration allow tenant-controlled Maven repository content to reach Maven execution inside the operator pod, which can allow tenant-controlled content to influence code execution in the operator context. CVE-2026-80352, rated critical, is a YAML injection (improper control of code generation) in the Master trait serviceAccountName setting: an authorized custom resource author can inject arbitrary Kubernetes objects, potentially enabling unauthorized resource manipulation; exploitation requires an authorized CR author within the cluster. CVE-2026-80354, rated moderate, is an authorization bypass via a user-controlled key in custom resource resolution: the Builder trait's mavenProfiles ValueSources resolve tenant-named secrets in the operator namespace, so a tenant can reference secrets by name and potentially expose secrets belonging to other tenants or the operator. All three issues break tenant isolation in multi-tenant Camel K deployments, with two of the three enabling code execution or arbitrary object application in or from the operator context. The three reports state identical affected and fixed version ranges; no discrepancies were found between them.