CVE-2026-80354: Apache Camel K Auth Bypass Vulnerability

CVE-2026-80354 Overview

CVE-2026-80354 is an authorization bypass vulnerability in Apache Camel K affecting the custom resource resolution logic. A tenant can reference secrets by name inside the operator namespace, exposing secrets that belong to other tenants or to operator components themselves. The flaw is classified as [CWE-639] Authorization Bypass Through User-Controlled Key. It affects Apache Camel K versions 2.0.0 through 2.9.2 and 2.10.1. Fixed releases are 2.9.3, 2.10.2, and 2.11.0.

Critical Impact

A low-privileged tenant in a multi-tenant Camel K deployment can read arbitrary secrets from the operator namespace, breaking tenant isolation.

Affected Products

• Apache Camel K 2.0.0 through 2.9.2
• Apache Camel K 2.10.1
• Multi-tenant Kubernetes deployments running the Camel K operator

Discovery Timeline

• 2026-09-10 - CVE-2026-80354 published to NVD
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80354

Vulnerability Analysis

Apache Camel K runs a shared operator that reconciles custom resources submitted by tenants. When a tenant custom resource references a secret by name, the operator resolves that reference within its own namespace rather than restricting resolution to the tenant's namespace. This allows a tenant to specify the name of any secret residing in the operator namespace and receive access to its contents at reconciliation time.

The operator namespace typically stores credentials for the Camel K control plane, registry authentication tokens, and integration secrets shared across tenants. Exposing these values breaks the tenant isolation contract expected in multi-tenant Kubernetes clusters.

Root Cause

The root cause is missing authorization enforcement on the secret reference field of a custom resource. The operator trusts a user-controlled key to identify the target secret and does not verify that the requesting tenant owns the referenced object. This is the pattern described by [CWE-639].

Attack Vector

An attacker requires the ability to create or modify Camel K custom resources in a tenant namespace. The attacker submits a resource that references a secret name known or guessed to exist in the operator namespace. The Camel K operator resolves the reference with its own service account privileges and surfaces the secret content to the tenant workload or reconciliation output. See the Apache Camel CVE-2026-80354 Advisory for the vendor description.

Detection Methods for CVE-2026-80354

Indicators of Compromise

• Camel K custom resources in tenant namespaces that reference secret names matching those in the operator namespace.
• Audit log entries showing the Camel K operator service account reading secrets that no tenant integration should require.
• Unexpected integration runtime environments containing credentials tied to the operator control plane.

Detection Strategies

• Query the Kubernetes API for Integration, Kamelet, and related Camel K resources and inspect any secretRef or equivalent fields for names outside the tenant's own namespace scope.
• Compare secret read events by the Camel K operator service account against a baseline of expected tenant secret names.
• Alert when reconciliation output or pod environment variables include secret values not originating from the tenant namespace.

Monitoring Recommendations

• Enable Kubernetes audit logging for all get and list operations on Secret objects in the Camel K operator namespace.
• Forward Camel K operator logs and Kubernetes audit logs to a centralized analytics platform for correlation.
• Track version drift of the camel-k-operator deployment to identify clusters still running vulnerable releases.

How to Mitigate CVE-2026-80354

Immediate Actions Required

• Upgrade Apache Camel K to 2.9.3, 2.10.2, or 2.11.0 on all clusters running the operator.
• Rotate any secrets stored in the Camel K operator namespace that could have been referenced by tenant workloads.
• Review recent custom resource submissions across tenant namespaces for suspicious secret references.

Patch Information

Apache has released fixed versions 2.9.3, 2.10.2, and 2.11.0 that enforce namespace-scoped authorization on secret references. Refer to the Apache Camel CVE-2026-80354 Advisory for upgrade instructions and version details.

Workarounds

• Restrict which users and service accounts can create or modify Camel K custom resources using Kubernetes RBAC.
• Move sensitive control-plane secrets out of the operator namespace where feasible until patching completes.
• Deploy dedicated Camel K operators per tenant namespace instead of a shared operator to remove cross-tenant exposure.

# Verify the running Camel K operator version and upgrade
kubectl -n camel-k get deployment camel-k-operator -o jsonpath='{.spec.template.spec.containers[0].image}'
kamel install --operator-image apache/camel-k:2.11.0 --force