CVE-2026-80352

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://camel.apache.org/security/CVE-2026-80352.html	Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/10/15	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:camel::::::::
	cpe:2.3:a:apache:camel::::::::

History

No history.

Information

Published : 2026-09-10 08:16

Updated : 2026-09-14 19:57

NVD link : CVE-2026-80352

Mitre link : CVE-2026-80352

CVE.ORG link : CVE-2026-80352

JSON object : View

Products Affected

apache

camel

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-80352", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80352", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-10T15:58:34.590571Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Camel K", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.9.3", "versionType": "semver"}, {"status": "affected", "version": "2.10.1", "lessThan": "2.10.2", "versionType": "semver"}], "packageURL": "pkg:docker/apache/camel-k", "packageName": "apache/camel-k", "collectionURL": "https://hub.docker.com", "defaultStatus": "unaffected"}]}], "published": "2026-09-10T08:16:59.070", "references": [{"url": "https://camel.apache.org/security/CVE-2026-80352.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/10/15", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K.\n\n\n\nA YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator.\n\n\n\nThis issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.\n\n\n\nUsers are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue."}], "lastModified": "2026-09-14T19:57:07.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "820E1202-D1F5-41E2-9C24-BF7ADDBCDF1D", "versionEndExcluding": "2.9.3", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9BF42EE-01CF-4929-9C6C-F39BDC142202", "versionEndExcluding": "2.10.2", "versionStartIncluding": "2.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}