Executive brief
Apache Camel K is an integration platform operator that manages containerized microservices. A vulnerability allows a tenant to access secrets belonging to other tenants or operator components by directly referencing secret names in the operator namespace, potentially compromising sensitive credentials and breaking tenant isolation in multi-tenant environments.
Technical details
The vulnerability exists in Apache Camel K's custom resource resolution logic, specifically in the Camel K Builder trait's mavenProfiles ValueSources functionality. The flaw allows a tenant to reference secrets by name in the operator namespace without proper authorization checks, bypassing multi-tenant isolation controls. An attacker with tenant-level access can exploit this to enumerate and access secrets from other tenants or operator infrastructure. No special authentication or network access is required beyond tenant privileges. The vulnerability affects versions from 2.0.0 before 2.9.3 and from 2.10.1 before 2.10.2. Patches are available in versions 2.9.3, 2.10.2, and 2.11.0.
Affected products
- Apache Camel K from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2
Timeline
- 2026-09-10: disclosed: CVE-2026-80354 published
- 2026-09-10: patched: Patches available in versions 2.9.3, 2.10.2, and 2.11.0