Paper/Archive/CVE-2026-80352

CVE-2026-80352

Apache Software Foundation Apache Camel K — Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

EPSS 0.8%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 57.7.577 × 2011.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

Affected

ProductAffectedFixed inSource

Apache Camel K2.0.0 – < 2.9.32.9.3CNA

Apache Camel K2.10.1 – < 2.10.22.10.2CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorycamel.apache.org/security/CVE-2026-80352.html refopenwall.com/lists/oss-security/2026/09/10/15