Executive brief
Apache Camel K is an integration framework used to build and deploy data integration solutions on Kubernetes. A vulnerability in how the platform processes custom resource configuration allows an authorized user to inject malicious YAML that creates arbitrary Kubernetes objects with the operator's elevated privileges, potentially compromising the entire cluster.
Technical details
This is a code injection vulnerability (CWE-94) in Apache Camel K's custom resource (CR) configuration handling. The vulnerability allows YAML injection through the master trait's serviceAccountName field, enabling an authorized CR author to inject arbitrary Kubernetes object definitions. Because the operator processes these injected objects with its own elevated service account privileges, an attacker can create unauthorized resources across the cluster. The attack requires CR authorship privileges but no additional network access. Patches are available in versions 2.9.3, 2.10.2, and 2.11.0.
Affected products
- Apache Camel K 2.0.0 to 2.9.2, 2.10.1 (fixed in 2.9.3, 2.10.2, 2.11.0)
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patches released in versions 2.9.3, 2.10.2, and 2.11.0