CVE-2026-45760CWE-610CWE-639

Apache Camel K: Camel K Cross-Namespace Build Deputy Attack

High · published May 21, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
31.4
In the wild
Unconfirmed
What it is

(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.

This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.

Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00386 · 31.4th percentile
Weaknesses
CWE-610 · Externally Controlled Reference to a Resource in Another Sphere; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-21T11:43Z
EPSS history
Timeline
  • 21 MAY 11:43Z
    Apache Camel K: Camel K Cross-Namespace Build Deputy Attack
    cvelistv5