CVE-2026-80352

CVE-2026-80352 is a flaw in Apache Camel K, the Kubernetes operator that builds and runs Camel integrations. The Apache Camel PMC published the advisory on 8 September 2026. The CVE record and the oss-security post followed on 10 September.

The bug sits in the Master trait, in its serviceAccountName setting. Apache calls it a YAML injection in custom resource configuration.

An authorized CR author can use it to inject arbitrary Kubernetes objects. Those objects are created with the privileges of the operator, not of the author. In a shared cluster, that can cross the line between a tenant and the cluster operator.

This is not an unauthenticated flaw. The attacker must already be allowed to write Camel K custom resources.

Affected: Camel K 2.0.0 before 2.9.3, and the 2.10 line before 2.10.2. The Apache table and NVD start the 2.10 range at 2.10.0, while the CVE record text says 2.10.1. Fixed: 2.9.3, 2.10.2 and 2.11.0.

Apache labels the severity Critical but published no CVSS score. CISA's ADP enrichment added a CVSS 3.1 score of 9.8 that assumes no privileges are needed. That does not match Apache's text, which requires an authorized CR author. We keep the score field empty.

The advisory credits internal analysis. It lists no workaround beyond the upgrade.

The CVE is not in the CISA KEV catalog (catalog 2026.10.23, checked 26 October 2026). CISA's SSVC entry sets exploitation to none. ThreatWire found no public proof of concept.

Read the full explainer on the eight Camel and Camel K flaws. The sibling Camel K flaw is CVE-2026-80351.