CVE-2026-80352 - Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

Back Back to CVE browser

CRITICAL

Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

Published Sep 10, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.84%

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K.

A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator.

This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

Affected products

Vendor Apache Software Foundation Product Apache Camel K Default
unaffected
- Version
  2.0.0
  Status
  affected
  Constraints
  <2.9.3
- Version
  2.10.1
  Status
  affected
  Constraints
  <2.10.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache Camel K

unaffected

Version	Status	Constraints
2.0.0	affected	<2.9.3
2.10.1	affected	<2.10.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (3)

http://www.openwall.com/lists/oss-security/2026/09/10/15
Mailing ListThird Party Advisory
https://camel.apache.org/security/CVE-2026-80352.html
vendor-advisoryPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75290
Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/09/10/15		Mailing ListThird Party Advisory
https://camel.apache.org/security/CVE-2026-80352.html		vendor-advisoryPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75290		Advisory