THE Apache Software Foundation released patches for three critical Apache Camel K vulnerabilities, identified as CVE-2026-80352, CVE-2026-80351 and CVE-2026-80354. The flaws enable remote code execution and an authorisation bypass in operator namespaces, potentially allowing a threat actor with access to a Camel K deployment to run arbitrary code and access secrets.
The article notes there had been no confirmed exploitation in the wild at the time, but the vulnerabilities are serious enough to warrant urgent updating of affected systems. Patches are available in Camel K releases, with fixes targeted at versions 2.9.3, 2.10.2 and 2.11.0.
In detail, CVE-2026-80352 involves YAML injection within custom resource configurations, where a malicious author could inject Kubernetes objects via the master trait service account name, enabling resource creation with the operator’s privileges. CVE-2026-80351 concerns improper neutralisation of directives in dynamically evaluated code, allowing an attacker to influence Maven configuration using tenant-controlled repository content to achieve arbitrary code execution inside the operator pod.
CVE-2026-80354 is an authorization bypass tied to the builder trait, permitting a tenant to reference secrets by name within the operator namespace and potentially access private secrets from other tenants. The affected release ranges cover Apache Camel K versions prior to 2.9.3 in the 2.0.0 line and prior to 2.10.2 in the 2.10.x line. Administrators should upgrade to 2.9.3, 2.10.2 or 2.11.0 promptly, following the official security advisories.