PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45760 Apache Software Foundation CVE debrief

CVE-2026-45760 affects Apache Camel K and involves an authorization bypass through a user-controlled key / externally controlled reference issue. According to the published description, an authorized user in a Kubernetes namespace can create a Build resource and influence where the resulting Pod is generated, including in the operator namespace. Apache recommends upgrading to a fixed release: 2.8.1, 2.9.2, or 2.10.1 depending on the line you are on.

Vendor
Apache Software Foundation
Product
Apache Camel K
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-05-21
Advisory published
2026-05-21
Advisory updated
2026-05-21

Who should care

Operators and platform teams running Apache Camel K on Kubernetes, especially clusters that let namespace users create Build resources or rely on namespace isolation for operator workloads.

Technical summary

The published advisory describes a namespace-boundary control issue in Apache Camel K. A user who is authorized in one Kubernetes namespace can create a Build resource that controls Pod generation in a namespace of their choosing, which may include the operator namespace. NVD lists the related weaknesses as CWE-610 and CWE-639. The affected versions are 2.0.0 before 2.8.1, 2.9.0 before 2.9.2, and 2.10.0 before 2.10.1.

Defensive priority

High

Recommended defensive actions

  • Upgrade Apache Camel K to 2.10.1, or to 2.9.2 / 2.8.1 if you are on those release lines.
  • Review which Kubernetes identities are allowed to create Build resources and restrict that permission to the minimum necessary set.
  • Audit whether Camel K Build resources can target namespaces beyond the requester’s own namespace, including the operator namespace.
  • Verify namespace isolation, admission controls, and RBAC policies around Camel K-managed resources.
  • Monitor for unexpected Build creation activity and Pod placement in operator or other sensitive namespaces.

Evidence notes

This debrief is based only on the supplied NVD entry and the linked Apache security advisory reference. The source corpus states the issue, affected version ranges, the fixed versions, the namespace-impacting behavior, and the listed weaknesses (CWE-610 and CWE-639). No CVSS score was provided in the supplied data, and no KEV entry was present.

Official resources

Published on 2026-05-21 in the supplied records; NVD references the Apache security advisory for the issue. No KEV listing was present in the supplied data.