CVE-2026-80354

Analyzed Analyzed - Analysis Complete

Authorization Bypass in Apache Camel K via User-Controlled Key

Publication date: 2026-09-10

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-80354

EUVD

EUVD-2026-75292

Affected Vendors & Products

Vendor	Product	Version / Range
apache	camel	From 2.0.0 (inc) to 2.9.3 (exc)
apache	camel	From 2.10.0 (inc) to 2.10.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an authorization bypass vulnerability in Apache Camel K where a tenant can access secrets by name in the operator namespace that belong to other tenants or operator components. It affects versions from 2.0.0 before 2.9.3 and from 2.10.1 before 2.10.2.

Detection Guidance

To detect this vulnerability, check Apache Camel K versions between 2.0.0-2.9.2 and 2.10.0-2.10.1. Verify if secrets are accessible across tenant namespaces. Inspect Camel K Builder trait mavenProfiles ValueSources for improper secret resolution. Review logs for unauthorized secret access attempts.

Impact Analysis

The vulnerability could lead to unauthorized information disclosure if a tenant accesses secrets not meant for them. This includes secrets belonging to other tenants or operator components, potentially exposing sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized disclosure of tenant secrets could result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade Apache Camel K to version 2.9.3, 2.10.2, or 2.11.0 or later to fix the authorization bypass vulnerability.

Hi! I’m here to help you understand CVE-2026-80354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70