Apache Camel K
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_camel_k:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Camel K (a36a3f13-6c01-5977-bf5b-6af8c8de0438) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-80354 |
vulnerable | 2026-09-16 04:32:40.258285 |
Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace
Authorization bypass through User-Controlled key vulnerability in Apache Camel K.
An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components.
This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.
Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.
Published: 2026-09-10T07:43:23.231Z
Updated: 2026-09-10T16:00:59.953Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-80351 |
vulnerable | 2026-09-16 04:32:40.108177 |
Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod
Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K.
An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator.
This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.
Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.
Published: 2026-09-10T07:42:57.856Z
Updated: 2026-09-10T16:00:02.698Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-80352 |
vulnerable | 2026-09-16 04:32:39.969486 |
Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K.
A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator.
This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.
Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.
Published: 2026-09-10T07:41:33.842Z
Updated: 2026-09-10T15:59:02.944Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45760 |
vulnerable | 2026-06-08 08:05:11.862900 |
Apache Camel K: Camel K Cross-Namespace Build Deputy Attack
(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.
This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.
Published: 2026-05-21T11:43:44.844Z
Updated: 2026-05-23T02:17:48.106Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.