CVE-2026-80351

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-80351

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80351.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-80351

Published

2026-09-10T07:42:57Z

Modified

2026-09-16T03:47:35Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Details

Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K.

An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator.

This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-95"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80351.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "2.9.3"
                },
                {
                    "introduced": "2.10.1"
                },
                {
                    "fixed": "2.10.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "2.9.3"
                },
                {
                    "introduced": "2.10.1"
                },
                {
                    "fixed": "2.10.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/apache/camel

Affected ranges

Type

GIT

Repo

https://github.com/apache/camel

Events

Introduced

6c88ad61b73dbfbc49c62624096ca0c250111430

Fixed

ea2d4facb741606baf372db6d4fb2dddff224c50

Introduced

4b7de2347b85ee27df04dfe9e3c27342b0e495ff

Fixed

c66dbd998f56aff14eb5def4558a1d0c77d037ea

Database specific

Show details

{
    "cpe": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.9.3"
        },
        {
            "introduced": "2.10.0"
        },
        {
            "fixed": "2.10.2"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80351.json"