EUVD-2026-31268
GHSA-q8ch-jx67-q52x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Kubernetes-API reachable (AV:N) with only Build-create rights (PR:L), no UI; impact crosses into the operator's security sphere so S:C; high C/I via operator authority, no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.
This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.
AnalysisAI
Cross-namespace privilege escalation in Apache Camel K (2.0.0-2.8.0, 2.9.0-2.9.1, 2.10.0) lets an authenticated Kubernetes user who can create Build resources dictate the target namespace for the resulting Pod, including the privileged operator namespace. By steering Pod generation into the operator's namespace, a tenant confined to their own namespace can break out of RBAC boundaries and interact with higher-privilege resources. CVSS 8.1; no public exploit identified at time of analysis and EPSS is negligible (0.02%), but SSVC rates the technical impact as total.
Technical ContextAI
Apache Camel K is a Kubernetes-native integration platform (built on Apache Camel) that runs as an operator and uses Custom Resources such as Integration and Build to drive the build-and-deploy lifecycle. The Build custom resource normally results in the operator scheduling builder Pods. The root cause is CWE-610 (Externally Controlled Reference to a Resource in Another Sphere) combined with an authorization-bypass-through-user-controlled-key pattern: a field controllable by the requesting user (the target namespace for Pod creation) is trusted without validating that the user is authorized in that namespace. Because the operator holds elevated service-account permissions, letting a low-privilege user select the operator namespace as the destination effectively borrows the operator's authority. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_camel_k.
RemediationAI
Vendor-released patch: upgrade to 2.10.1 (or the fixed backports 2.8.1 and 2.9.2) matching your minor line, per the Apache advisory at https://camel.apache.org/security/CVE-2026-45760.html and the oss-security disclosure at http://www.openwall.com/lists/oss-security/2026/05/21/8. If immediate upgrade is not possible, reduce exposure by tightening Kubernetes RBAC so that non-administrative tenants cannot create or modify Build custom resources (remove create/update verbs on builds.camel.apache.org from tenant roles) - the trade-off is that affected users lose the ability to trigger their own builds. Additionally, enforce namespace isolation with admission controls (e.g., an OPA/Gatekeeper or ValidatingAdmissionPolicy that rejects Build resources whose target namespace differs from the requester's own), accepting the operational cost of maintaining that policy. These controls limit the cross-namespace abuse until patching completes.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today