CVE-2026-80352: Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K.
A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator.
This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.
Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camel Kto a version that resolves this vulnerability.Fixed in 2.9.3 - Upgrade
Upgrade
Apache Camel Kto a version that resolves this vulnerability.Fixed in 2.10.2 - Upgrade
Upgrade
Apache Camel Kto a version that resolves this vulnerability.Fixed in 2.11.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authorized Camel K custom resource author can exploit it by supplying crafted custom resource configuration. The impact depends on the privileges held by the Camel K operator, because injected Kubernetes objects may be created with those privileges.
Which Camel K versions need to be upgraded?
Affected versions are 2.0.0 through before 2.9.3, and 2.10.1 through before 2.10.2. Upgrade to 2.9.3, 2.10.2, or 2.11.0.