1059 matches found
CVE-2026-80352
Apache Camel K is vulnerable to a YAML injection in the Master trait serviceAccountName field of custom resource configuration. An authorized CR author can inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator . The vulnerabil...
EUVD-2026-75290
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges o...
CVE-2026-80352 Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges o...
Exploit for Improper Handling of Case Sensitivity in Apache Camel
CVE-2025-27636 – Apache Camel RCE Simple Python exploit for t...
PT-2026-89301
Name of the Vulnerable Software and Affected Versions Apache Camel K versions 2.0.0 through 2.9.2 Apache Camel K versions 2.10.1 through 2.10.1 Description An eval injection occurs due to improper neutralization of directives in dynamically evaluated Maven configuration. This allows content from...
PT-2026-89302
Name of the Vulnerable Software and Affected Versions Apache Camel K versions 2.0.0 through 2.9.2 Apache Camel K versions 2.10.1 through 2.10.1 Description A YAML injection issue in the custom resource configuration allows an authorized author to inject arbitrary Kubernetes objects. This can lead...
PT-2026-89303
Name of the Vulnerable Software and Affected Versions Apache Camel K versions 2.0.0 through 2.9.2 Apache Camel K versions 2.10.1 through 2.10.1 Description An authorization bypass exists in custom resource resolution that allows a tenant to reference secrets by name within the operator namespace...
CVE-2026-80354: Authorization Bypass Through User-Controlled Key
Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components. Th...
CVE-2026-80352: Improper Control of Generation of Code
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges o...
CVE-2026-80351: Improper Neutralization of Directives in Dynamically Evaluated Code
Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...
Critical: Red Hat Security Advisory: Updated Container Images: HawtIO 4.4.1 for Red Hat build of Apache Camel 4 Release and security update.
Updated container images are now available The container images have been updated to address the following security advisory: RHSA-2026:42952 see References Users of container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues,...
CVE-2026-48206
A flaw was found in the Apache Camel JIRA component. Due to improper input validation, non-Camel-prefixed Exchange header constants can bypass the HTTP header filter. This allows a remote attacker, potentially unauthenticated, to supply specific headers and override intended values. Consequently,...
The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel, which allows attackers to bypass existing security mechanisms
The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms remotely...
CVE-2026-66908
A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token JWT authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any...
CVE-2026-63621
A flaw was found in Apache Camel Knative component. The Knative consumer in camel-knative improperly handles CloudEvent extension fields in structured content mode, copying them directly into message headers without proper filtering. This allows an unauthenticated attacker to inject internal Came...
Header Injection
Apache Camel Knative component is vulnerable to Header Injection. The vulnerability is due to structured CloudEvent extension fields being copied into Exchange headers without filtering, allowing an attacker to inject Camel-internal headers and influence downstream components, potentially enablin...
WebSocket Header Injection
Apache Camel Atmosphere Websocket component is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered websocket.connectionKey and websocket.connectionKey.list headers controlling WebSocket message dispatch, allowing an external sender to suppress or redirect messages to a...
Path Traversal
Apache Camel Azure-Storage Datalake component is vulnerable to Path Traversal. The vulnerability is due to DataLakeFileOperations.downloadToFile joining the configured fileDir with an unvalidated remote path name, allowing an attacker to influence Data Lake file names and cause files to be create...
Path Traversal
Apache Camel is vulnerable to Path Traversal. The vulnerability is due to the Azure Storage Blob component constructing local file paths directly from attacker-influenced blob names without path normalization or containment checks, which allows an attacker to create or overwrite files outside the...
