CVE-2026-80352

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-80352

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80352.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-80352

Published

2026-09-10T07:41:33Z

Modified

2026-09-16T03:47:35Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

Details

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K.

A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator.

This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

Database specific

{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80352.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "2.0.0"
                },
                {
                    "fixed":  "2.9.3"
                },
                {
                    "introduced":  "2.10.1"
                },
                {
                    "fixed":  "2.10.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "introduced":  "2.0.0"
                },
                {
                    "fixed":  "2.9.3"
                },
                {
                    "introduced":  "2.10.1"
                },
                {
                    "fixed":  "2.10.2"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/apache/camel

Affected ranges

Type

GIT

Repo

https://github.com/apache/camel

Events

Introduced

6c88ad61b73dbfbc49c62624096ca0c250111430

Fixed

ea2d4facb741606baf372db6d4fb2dddff224c50

Introduced

4b7de2347b85ee27df04dfe9e3c27342b0e495ff

Fixed

c66dbd998f56aff14eb5def4558a1d0c77d037ea

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "2.0.0"
        },
        {
            "fixed":  "2.9.3"
        },
        {
            "introduced":  "2.10.0"
        },
        {
            "fixed":  "2.10.2"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80352.json"