Executive brief
Apache Camel K is a framework used to run integration software on Kubernetes. A security flaw allows users who already have access to a specific workspace (namespace) to bypass security boundaries and create computing resources in other workspaces, including those reserved for system administrators. This could allow an attacker to gain unauthorized access to sensitive data or interfere with the management of the entire integration platform.
Technical details
An authorization bypass vulnerability (CWE-639) and externally controlled reference (CWE-610) exists in Apache Camel K. The vulnerability allows an authenticated user with permissions to create resources in a specific Kubernetes namespace to manipulate the 'Build' resource to trigger Pod generation in an arbitrary namespace, such as the operator's namespace. This 'Cross-Namespace Build Deputy Attack' occurs because the system fails to properly restrict the target namespace for builder pods, relying on user-controlled keys rather than inferring the namespace from the Build custom resource's own context. Attackers can exploit this to escalate privileges or access sensitive resources across namespace boundaries. The issue is fixed in versions 2.8.1, 2.9.2, and 2.10.1 by deprecating the user-specified builder pod namespace and inferring it automatically.
Affected products
- Apache Camel K 2.0.0 before 2.8.1, 2.9.0 before 2.9.2, 2.10.0 before 2.10.1
Timeline
- 2026-05-14: patched: Fixes merged into release branches 2.8.x, 2.9.x, and 2.10.x
- 2026-05-21: disclosed: Public disclosure of CVE-2026-45760
- 2026-05-21: advisory: GitHub Advisory GHSA-q8ch-jx67-q52x published