CVE-2026-80351 Apache Software Foundation CVE debrief

Who should care

Defenders and administrators of Apache Camel K systems should assess exposure and prioritize remediation to prevent potential code execution with operator privileges. This includes reviewing affected versions, assessing system configurations, and implementing compensating controls where necessary. Security teams and vulnerability management teams should track exceptions and retest remediated assets.

Why it matters

CVE-2026-80351 is a critical eval injection vulnerability in Apache Camel K that allows tenant-controlled repository content to influence code execution within the operator pod. Defenders and administrators of Apache Camel K systems should assess exposure and prioritize remediation to prevent potential code execution with operator privileges.

• Potential code execution with operator privileges
• Tenant-controlled repository content influencing code execution
• Arbitrary code execution possible if not mitigated

Technical summary

Improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator. Affected product context includes Apache Camel K versions from 2.0.0 before 2.9.3 and from 2.10.1 before 2.10.2. Defensive impact involves upgrading to fixed versions and assessing exposure to prevent potential code execution with operator privileges.

Defensive priority

Upgrade to fixed versions and assess exposure

Recommended defensive actions

• Upgrade Apache Camel K to version 2.9.3, 2.10.2, or 2.11.0
• Assess exposure and prioritize remediation
• Review and update inventory of affected systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and affected versions. Tenant-controlled repository content can influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator. Affected versions are Apache Camel K from 2.0.0 before 2.9.3 and from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2, or 2.11.0. Evidence is limited to public CVE details and NVD assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.