CVE-2026-80351 & CVE-2026-80352: 9.8 CVSS Apache Camel K Vulnerabilities

The Apache Software Foundation released patches addressing three critical Apache Camel K vulnerabilities. These flaws allow attackers to execute arbitrary code and bypass authorization checks within operator namespaces. Consequently, development teams must update their integrations immediately.

Why This Matters

Apache Camel K is a lightweight integration framework that runs natively on Kubernetes environments. Developers use it to connect cloud-native applications and process enterprise data streams. Therefore, unpatched Apache Camel K vulnerabilities create massive risks for containerized clusters. If threat actors exploit these flaws, they can execute code with operator privileges. This level of access allows attackers to extract sensitive secrets across isolated tenant namespaces, compromising the entire cluster.

How the Attacks Work

The highest severity flaws allow remote code execution via injection methods. First, CVE-2026-80352 involves YAML injection within custom resource configurations. A malicious author can inject arbitrary Kubernetes objects through the master trait service account name. This action enables unauthorized resource creation using the operator’s privileges.

Meanwhile, CVE-2026-80351 involves improper neutralization of directives in dynamically evaluated code. An attacker uses tenant-controlled repository content to influence the Maven configuration. This enables eval injection, allowing the execution of arbitrary code inside the operator pod.

Finally, CVE-2026-80354 is a moderate-severity authorization bypass. The builder trait allows a tenant to reference secrets by name within the operator namespace. Consequently, an attacker can access private secrets belonging to other tenants.

Affected Versions

These security flaws impact multiple release branches. Specifically, they affect Apache Camel K versions 2.0.0 before 2.9.3 and versions 2.10.1 before 2.10.2. At this time, researchers have confirmed no active exploitation in the wild. Furthermore, no public proof-of-concept exploits currently exist.

Patch and Mitigation Steps

Administrators must upgrade their deployments immediately to protect their container environments. The Apache Camel team fixed these flaws in versions 2.9.3, 2.10.2, and 2.11.0. You can review the official Apache Camel security advisories for deeper technical context. To secure your clusters, obtain the updated packages directly from the Apache Camel download page.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.