CVE-2026-80352CWE-94code-injection

CVE-2026-80352

Critical · published September 10, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K.

A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator.

This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00836 · 57.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-10T12:16Z
Affected products (2)
ProductVersionsFixed in
apache/camel≥ 2.0.0, < 2.9.32.9.3
apache/camel≥ 2.10.0, < 2.10.22.10.2
References (2)
https://camel.apache.org/security/CVE-2026-80352.html · [email protected]http://www.openwall.com/lists/oss-security/2026/09/10/15 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 10 SEP 07:41Z
    Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
    cvelistv5