External risk intelligence

Apache Camel K Eval Injection Allows Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-80351

The vulnerability exists within the Apache Camel K operator, which is a Kubernetes-native tool for managing integrations. Operators typically reside within the internal cluster control plane and are not exposed directly to the public internet, making public network reachability uncommon in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability found in Apache Camel K, a technology used for managing integrations. The issue involves how the system handles dynamically evaluated code, which could allow unauthorized code execution within the operator pod. This has the potential to impact the security and integrity of systems running this software.

Code injection flaw in integration management software.
Could allow arbitrary code execution within the system.
Verify relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could potentially gain control of the Apache Camel K operator by influencing its Maven configuration with malicious content. This could allow them to execute arbitrary code with the operator's privileges within the cluster.

Tenant-controlled repository content.
Dynamically evaluated Maven configuration.
Arbitrary code execution within the operator.

Live Threat

Current exploitation, exposure, and threat context

An improper neutralization of directives in dynamically evaluated Maven configuration could allow tenants to influence code execution within the operator pod. This may enable tenants to execute arbitrary code with the privileges of the operator, when supported by the advisory.

Operator pod code execution.
Tenant-controlled repository content influences code.
Arbitrary code execution with operator privileges.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Apache Camel K's operator pod could allow tenants to execute arbitrary code by influencing Maven configuration. The first practical step is for platform or infrastructure teams to identify all Camel K deployments, confirm their reachability and criticality, and then coordinate with application owners or the vendor for remediation.

Platform or infrastructure teams own this issue.
Verify tenant access and configuration reachability.
Plan remediation with vendor and application owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Camel K?

Apache Camel K is a lightweight integration framework built for Kubernetes. It allows developers to run integration flows—which connect different systems, APIs, or data sources—directly on a cluster. By using the Camel K operator, teams can manage these integrations as native Kubernetes resources, simplifying the lifecycle of complex data movement tasks.

What does CWE-95 mean for CVE-2026-80351?

CWE-95 refers to Improper Neutralization of Directives in Dynamically Evaluated Code, often called eval injection. In this CVE, the vulnerability occurs because the Camel K operator processes Maven configuration data in a way that treats input as executable commands. If this data is not properly sanitized, an attacker can trick the system into running unintended code.

How can an attacker trigger this vulnerability?

An attacker needs the ability to influence the Maven configuration content that the Camel K operator processes. By injecting malicious directives into these configuration files, the attacker causes the operator to execute code under its own security context. Simply accessing the cluster is not enough; the attacker must have a path to provide or modify the repository content used by the operator.

Is my environment at risk if it is not internet-facing?

Halo Surface Signal indicates that while this is a network-based vulnerability, the Apache Camel K operator typically functions within the internal cluster control plane. Because these operators are rarely exposed directly to the public internet, the risk is lower for standard deployments. You should focus on assessing who has the necessary permissions to influence the operator's configurations internally.

What are the first steps to address this CVE?

Begin by identifying all active Camel K deployments within your Kubernetes clusters. Once mapped, confirm whether your current versions fall within the affected ranges. Coordinate with your platform teams to plan an upgrade to one of the patched versions—2.9.3, 2.10.2, or 2.11.0—as these releases contain the necessary fixes to neutralize the evaluation flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.