CVE-2026-80352: Apache Camel K YAML Injection RCE Vulnerability

CVE-2026-80352 Overview

CVE-2026-80352 is a code injection vulnerability in Apache Camel K caused by improper handling of YAML content in custom resource (CR) configurations. An authorized CR author can inject arbitrary Kubernetes objects through the affected configuration paths. Injected objects are created with the privileges of the Camel K operator, which typically holds elevated permissions in the cluster namespace.

The flaw is tracked under CWE-94: Improper Control of Generation of Code. It affects Apache Camel K versions 2.0.0 through 2.9.2 and 2.10.1. Fixed releases are 2.9.3, 2.10.2, and 2.11.0.

Critical Impact

An authorized custom resource author can create arbitrary Kubernetes objects with operator privileges, enabling unauthorized resource creation and potential privilege escalation within the cluster namespace.

Affected Products

• Apache Camel K 2.0.0 through 2.9.2
• Apache Camel K 2.10.1
• Kubernetes clusters running the Camel K operator

Discovery Timeline

• 2026-09-10 - CVE-2026-80352 published to NVD
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80352

Vulnerability Analysis

Apache Camel K is a Kubernetes-native integration platform that runs Apache Camel routes on Kubernetes clusters. The operator processes custom resources (CRs) submitted by users and translates them into cluster objects such as Deployments, ConfigMaps, and Services.

The vulnerability resides in how the operator processes YAML content embedded in CR configuration fields. Instead of treating user-supplied YAML strictly as data, the operator interprets it in a way that permits arbitrary Kubernetes object definitions to be inlined and materialized in the cluster. This behavior is classified under CWE-94 because attacker-controlled input alters the set of objects the operator generates.

Because the operator acts on behalf of itself when creating objects, injected resources inherit the operator's service account permissions rather than those of the CR author. This crosses a trust boundary: the CR author's namespaced write capability becomes whatever the operator is authorized to do.

Root Cause

The root cause is unsafe YAML parsing and object generation logic in custom resource configuration handling. The operator does not restrict the schema, kind, or apiVersion of objects derivable from CR input. Any authorized submitter of the affected CRs can influence the object graph the operator produces.

Attack Vector

Exploitation requires an authenticated user with permission to create or modify the affected Camel K custom resources in a namespace. The attacker embeds a crafted YAML payload in a vulnerable configuration field. When the operator reconciles the CR, it generates and applies the attacker-defined Kubernetes objects using its own credentials.

Depending on the operator's RBAC bindings, the attacker may create RoleBindings, Secrets, Jobs, or workloads that would otherwise be outside their reach. Refer to the Apache Camel Security Advisory CVE-2026-80352 for vendor-supplied technical details.

Detection Methods for CVE-2026-80352

Indicators of Compromise

• Camel K custom resources containing embedded YAML that defines unrelated Kubernetes object kinds such as RoleBinding, ClusterRoleBinding, Secret, or Job.
• Kubernetes audit events showing the Camel K operator service account creating object kinds that fall outside normal integration workloads.
• Newly created workloads or RBAC objects in namespaces managed by Camel K whose ownership references trace back to a CR author's submission.

Detection Strategies

• Review Kubernetes API server audit logs for create and update actions performed by the Camel K operator service account, filtering for object kinds not typical of integration deployments.
• Compare the object graph produced by each Camel K CR against an allow-list of expected kinds (Deployment, Service, ConfigMap, Integration).
• Inventory all cluster nodes and namespaces running Camel K versions in the 2.0.0–2.9.2 and 2.10.1 ranges.

Monitoring Recommendations

• Enable Kubernetes audit logging at the RequestResponse level for the namespaces where the Camel K operator runs.
• Alert on any modification to RBAC objects (Role, RoleBinding, ClusterRole, ClusterRoleBinding) created by workload operator service accounts.
• Track version drift of the Camel K operator across clusters to identify unpatched deployments.

How to Mitigate CVE-2026-80352

Immediate Actions Required

• Upgrade Apache Camel K to 2.9.3, 2.10.2, or 2.11.0 per the vendor advisory.
• Audit existing custom resources in all namespaces for embedded YAML that defines Kubernetes objects other than expected integration artifacts.
• Rotate any credentials or Secrets that may have been exposed through operator-created objects.

Patch Information

The Apache Camel project has released fixed versions 2.9.3, 2.10.2, and 2.11.0 that address the YAML injection in custom resource configuration handling. Consult the Apache Camel Security Advisory CVE-2026-80352 for the complete upgrade guidance and release notes.

Workarounds

• Restrict CR author permissions using Kubernetes RBAC so only trusted users can create or modify Camel K custom resources.
• Apply an admission controller policy (for example, OPA Gatekeeper or Kyverno) that rejects Camel K CRs containing embedded object kinds outside the expected schema.
• Deploy the Camel K operator with the minimum RBAC scope required, avoiding cluster-wide roles when a namespaced role is sufficient.

# Example Kyverno policy: block Camel K CRs whose YAML fields reference RBAC kinds
# Apply with: kubectl apply -f block-camelk-rbac-injection.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-camelk-rbac-injection
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-embedded-rbac-kinds
      match:
        any:
          - resources:
              kinds:
                - Integration
                - IntegrationKit
                - IntegrationPlatform
      validate:
        message: "Embedded RBAC or Secret objects are not permitted in Camel K CRs."
        pattern:
          spec:
            X(configuration): "!*RoleBinding*&!*ClusterRoleBinding*&!*Secret*"