CVE-2026-80351: Apache Camel K Eval Injection RCE Vulnerability

CVE-2026-80351 Overview

CVE-2026-80351 is an eval injection vulnerability in Apache Camel K, the Kubernetes-native integration platform based on Apache Camel. The flaw resides in the dynamic evaluation of Maven configuration inside the Camel K operator. Tenant-controlled repository content can influence code executed inside the operator pod, enabling code execution under the operator's privileges. This creates a tenant-to-operator privilege escalation path in multi-tenant Kubernetes clusters running Camel K. The issue is tracked under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code.

Critical Impact
Tenants providing malicious Maven repository content can execute arbitrary code with the Camel K operator's service account privileges, potentially compromising other tenants and cluster resources.

Affected Products

Apache Camel K versions 2.0.0 through 2.9.2
Apache Camel K versions 2.10.1 (fixed in 2.10.2)
Apache Camel K operator deployments on Kubernetes and OpenShift

Discovery Timeline

2026-09-10 - CVE-2026-80351 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80351

Vulnerability Analysis

Apache Camel K compiles and runs integrations by delegating Maven-based builds to the operator pod. During the build process, the operator dynamically evaluates Maven configuration that can incorporate tenant-supplied values, including repository definitions and associated metadata.

Because directives inside this evaluated configuration are not properly neutralized, tenant-controlled repository content becomes a code execution surface. An attacker with permission to create or modify Camel K integrations can inject Maven configuration fragments that execute inside the operator pod.

The operator typically runs with elevated service account privileges to manage integrations across namespaces. Code executed in this context can read secrets mounted to the operator, access the Kubernetes API with operator permissions, and pivot to other tenants in shared clusters.

Root Cause

The root cause is improper neutralization of directives within dynamically evaluated Maven configuration [CWE-95]. Tenant-provided repository content is trusted as inert data but is instead interpreted as executable directives when Maven configuration is generated and evaluated inside the operator.

Attack Vector

A tenant with the ability to submit or modify Camel K integrations supplies crafted Maven repository content. When the operator processes this content during build orchestration, the injected directives execute in the operator process. Refer to the Apache Camel CVE-2026-80351 Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-80351

Indicators of Compromise

Unexpected outbound network connections from the Camel K operator pod to attacker-controlled Maven repositories or hosts.
Unusual process execution within the operator container, particularly shell invocations or downloads triggered during Maven builds.
Kubernetes audit log entries showing the operator service account accessing secrets or resources outside its normal reconciliation pattern.

Detection Strategies

Inventory Camel K installations and confirm versions against the affected ranges (2.0.0–2.9.2 and 2.10.1).
Inspect IntegrationKit, Build, and integration resources for suspicious Maven repository URLs or POM fragments supplied by tenants.
Correlate operator pod runtime telemetry with tenant integration submissions to identify malicious build payloads.

Monitoring Recommendations

Enable Kubernetes audit logging for the Camel K operator namespace and forward events to a centralized analytics platform.
Monitor operator pod egress traffic and alert on connections to Maven repositories outside an approved allowlist.
Track child process creation inside the operator container and alert on interpreters or reverse-shell patterns.

How to Mitigate CVE-2026-80351

Immediate Actions Required

Upgrade Apache Camel K to 2.9.3, 2.10.2, or 2.11.0 in all affected clusters.
Restrict which tenants and service accounts can create or modify Camel K integration resources until patching is complete.
Rotate credentials and tokens accessible to the Camel K operator pod if compromise is suspected.

Patch Information

Apache has released fixed versions 2.9.3, 2.10.2, and 2.11.0 that address the eval injection flaw. See the Apache Camel CVE-2026-80351 Advisory for upgrade guidance and release notes.

Workarounds

Constrain Maven repository configuration to a cluster-administered allowlist and reject tenant-supplied repositories.
Apply Kubernetes RBAC to prevent untrusted tenants from creating Camel K integration or build resources.
Run the Camel K operator with the minimum service account privileges required and isolate it in a dedicated namespace with network policies limiting egress.

bash

# Configuration example
# Verify installed Camel K version and upgrade using the kamel CLI
kamel version
kamel install --olm=false --force --operator-image apache/camel-k:2.10.2