Vulnerability intelligence

CVE-2026-103413

Apache Software Foundation Apache Camel Karavan CWE-20

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan apply arbitrary Kubernetes resources within the reach of its service account, including pods requesting hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation or added capabilities. This issue affects Apache Camel Karavan: from 4.0.0 before 4.22.1. Users are recommended to upgrade to version 4.22.1, which fixes the issue.

CVSS Score

8.8

High

EPSS — Exploit Probability

0.4%

Riskier than 31% of all CVEs · checked 2026-10-11

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

No linked coverage yet. CyberSIXT tracks this CVE and coverage will appear here.

Related CVEs — Apache Software Foundation

CVE-2026-103412 CVE-2026-92414 CVE-2026-92415 CVE-2026-59265 CVE-2026-91135 CVE-2026-83632 CVE-2026-61373 CVE-2026-63772