CVE-2026-80351

CVE-2026-80351 is a flaw in Apache Camel K, the Kubernetes operator that builds and runs Camel integrations. The Apache Camel PMC published the advisory on 8 September 2026. The CVE record and the oss-security post followed on 10 September.

The operator runs Maven to build integrations. Apache says the Maven configuration it evaluates did not neutralize directives coming from tenant-controlled repository content. Apache classifies it as eval injection.

The result is code execution inside the operator pod, with the operator's privileges. A tenant should not be able to reach that level.

The attacker is a tenant who can point Camel K at repository content they control. The advisory does not describe an unauthenticated path.

Affected: Camel K 2.0.0 before 2.9.3, and the 2.10 line before 2.10.2. The Apache table and NVD start the 2.10 range at 2.10.0, while the CVE record text says 2.10.1. Fixed: 2.9.3, 2.10.2 and 2.11.0.

Apache labels the severity Critical but published no CVSS score. CISA's ADP enrichment added a CVSS 3.1 score of 9.8 that assumes no privileges are needed. Apache's text describes a tenant, so we keep the score field empty.

The advisory credits internal analysis and lists no workaround beyond the upgrade.

The CVE is not in the CISA KEV catalog (catalog 2026.10.23, checked 26 October 2026). CISA's SSVC entry sets exploitation to none. ThreatWire found no public proof of concept.

Read the full explainer on the eight Camel and Camel K flaws. The sibling Camel K flaw is CVE-2026-80352.