Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the prepareRBAC function in the master trait. An authorized custom resource author can supply a service account name containing a newline, which is inserted into RBAC YAML templates and lets them inject...

CVE-2026-80352

Apache Camel K is vulnerable to a YAML injection in the Master trait serviceAccountName field of custom resource configuration. An authorized CR author can inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator . The vulnerabil...