EUVD-2026-75292
GHSA-3r9g-8jw6-fcwx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Low-privileged CR-author exfiltrates cross-tenant secrets remotely; I:H overstated since description only confirms disclosure, not secret modification.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
Authorization bypass through User-Controlled key vulnerability in Apache Camel K.
An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components.
This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.
Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.
AnalysisAI
Cross-tenant secret disclosure in Apache Camel K's custom resource resolution allows an authenticated tenant to reference secrets by name in the shared operator namespace, bypassing authorization boundaries that should isolate tenants from each other. Versions from 2.0.0 before 2.9.3 and from 2.10.1 before 2.10.2 are affected in multi-tenant deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account with permission to author or submit Custom Resources (CRs) in a shared Apache Camel K deployment where multiple tenants or operator components share the same operator Kubernetes namespace. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) identifies a serious multi-tenant isolation failure requiring only a low-privileged authenticated account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache Camel K to version 2.9.3, 2.10.2, or 2.11.0, all of which contain the authorization fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Camel K installations and document current versions to identify affected deployments (versions 2.0.0-2.9.2 and 2.10.1). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Camel K
View allCross-tenant remote code execution in Apache Camel K (2.0.0 before 2.9.3, and 2.10.1 before 2.10.2) arises from improper
Code injection in Apache Camel K (2.0.0-2.9.2 and 2.10.1) lets an authorized custom-resource author smuggle arbitrary Ku
Cross-namespace privilege escalation in Apache Camel K (2.0.0-2.8.0, 2.9.0-2.9.1, 2.10.0) lets an authenticated Kubernet
Share
External POC / Exploit Code
Leaving vuln.today