GHSA-q8ch-jx67-q52x

Source

https://github.com/advisories/GHSA-q8ch-jx67-q52x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-q8ch-jx67-q52x/GHSA-q8ch-jx67-q52x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q8ch-jx67-q52x

Aliases

CVE-2026-45760
GO-2026-5573

Published

2026-05-21T15:34:09Z

Modified

2026-06-25T23:11:35Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Apache Camel K: Kubernetes namespace authorized users can create a Build resource

Details

(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.

This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.

Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-610",
        "CWE-639"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-23T21:50:20Z",
    "nvd_published_at":  "2026-05-21T13:16:19Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/apache/camel-k/v2

Package

Name: github.com/apache/camel-k/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/camel-k/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.8.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-q8ch-jx67-q52x/GHSA-q8ch-jx67-q52x.json"

Go / github.com/apache/camel-k/v2

Package

Name: github.com/apache/camel-k/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/camel-k/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.9.0

Fixed

2.9.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-q8ch-jx67-q52x/GHSA-q8ch-jx67-q52x.json"

Go / github.com/apache/camel-k/v2

Package

Name: github.com/apache/camel-k/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/camel-k/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.10.0

Fixed

2.10.1

Affected versions

2.*

2.10.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-q8ch-jx67-q52x/GHSA-q8ch-jx67-q52x.json"