CVE-2026-80352 Apache Software Foundation CVE debrief

Who should care

Apache Camel K users and administrators should assess exposure and prioritize remediation. This includes reviewing and updating inventory of Apache Camel K deployments, confirming whether affected product deployments exist in managed environments, and assigning an owner for follow-up. Users should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-80352 is a critical vulnerability in Apache Camel K that allows code injection, potentially leading to unauthorized resource creation. Affected versions require immediate attention and upgrading to fixed versions is recommended.

• Potential unauthorized resource creation
• Privilege escalation for authorized CR authors
• Need for version upgrade and inventory review

Technical summary

A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K from 2.0.0 before 2.9.3 and from 2.10.1 before 2.10.2. The vulnerability can be mitigated by upgrading to version 2.9.3, 2.10.2, or 2.11.0. The CVE record and NVD entry provide additional details on the vulnerability and affected versions. Affected users should assess exposure and prioritize remediation.

Defensive priority

Upgrade to fixed versions and assess exposure

Recommended defensive actions

• Upgrade Apache Camel K to version 2.9.3, 2.10.2, or 2.11.0
• Assess exposure and prioritize remediation
• Review and update inventory of Apache Camel K deployments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and affected versions. The vulnerability allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. Affected versions are Apache Camel K from 2.0.0 before 2.9.3 and from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2, or 2.11.0. Evidence is limited to public CVE and NVD information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.