CVE-2026-80352

Analyzed Analyzed - Analysis Complete

Code Injection in Apache Camel K

Publication date: 2026-09-10

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-80352

EUVD

EUVD-2026-75290

Affected Vendors & Products

Vendor	Product	Version / Range
apache	camel	From 2.0.0 (inc) to 2.9.3 (exc)
apache	camel	From 2.10.0 (inc) to 2.10.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-80352 is a code injection vulnerability in Apache Camel K where an authorized custom resource author can inject arbitrary Kubernetes objects via YAML injection in the Master trait's serviceAccountName configuration. This allows unauthorized resource creation with the operator's privileges.

Detection Guidance

To detect this vulnerability, check Apache Camel K versions for affected releases (2.0.0 to 2.9.2 and 2.10.0 to 2.10.1). Inspect custom resource configurations for YAML injection in the Master trait's serviceAccountName field. Look for unauthorized Kubernetes objects created with operator privileges.

Impact Analysis

This vulnerability allows attackers with authorized access to create custom resources to inject malicious Kubernetes objects. This could lead to unauthorized resource creation, privilege escalation, or further compromise of the cluster depending on the operator's permissions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized resource creation through YAML injection. If exploited, it may lead to unauthorized access or data exposure, which are key concerns under these regulations.

Mitigation Strategies

Upgrade Apache Camel K to version 2.9.3, 2.10.2, or 2.11.0 or later to fix the vulnerability. Review custom resource configurations for YAML injection in the Master trait's serviceAccountName field.

Hi! I’m here to help you understand CVE-2026-80352. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70