CVE-2026-80351
Apache Camel K contains an eval injection vulnerability (CWE-95) that lets tenant-controlled Maven configuration influence code execution in the operator pod, potentially allowing arbitrary code execution with operator privileges. The flaw affects versions 2.0.0 through 2.9.2 and 2.10.1 through 2.10.1, and has a CVSS base score of 9.8 (critical).
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Apache Camel K users running affected versions.
Real-world impact
An attacker could execute arbitrary code with the privileges of the operator pod, leading to full compromise of the affected environment.
Why this severity
CVSS 9.8 reflects a network‑accessible attack with low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
- 01Upgrade Apache Camel K to version 2.9.3, 2.10.2, or 2.11.0.
NVD description
Timeline
- Sep 10, 2026 · 4d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.