External risk intelligence

Apache Camel K YAML Injection Allows Arbitrary Kubernetes Object Creation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-80352

This vulnerability affects a Kubernetes operator (Apache Camel K) and requires the attacker to be an authorized Custom Resource author. Such access is typically restricted to internal developers, administrators, or CI/CD pipelines, making direct public internet exposure uncommon in standard deployments.

Code Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A code injection vulnerability exists in Apache Camel K, allowing authorized users to insert unauthorized Kubernetes objects. This could lead to the creation of new resources using the operator's permissions, potentially impacting system integrity and control.

Authorized users can inject unauthorized code.
It impacts system control and integrity.
Assess relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to create or modify custom resources in Kubernetes could exploit this vulnerability. By crafting a malicious YAML payload, they could inject arbitrary Kubernetes objects, allowing them to create unauthorized resources that run with the operator's privileges. This could lead to the creation of new services, modification of existing ones, or other actions within the Kubernetes cluster.

Requires authorized custom resource author access.
Injects arbitrary Kubernetes objects via YAML.
Enables unauthorized resource creation.

Live Threat

Current exploitation, exposure, and threat context

An authorized user with the ability to author custom resources in Apache Camel K could potentially inject malicious YAML. This could lead to the creation of unauthorized Kubernetes objects, which would then run with the privileges of the Camel K operator.

Kubernetes objects and operator privileges.
Via crafted custom resource configurations.
Unauthorized resource creation and privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Apache Camel K, which allows for code injection via custom resource configuration, primarily impacts teams managing Kubernetes environments and the applications deployed within them. The first practical step involves identifying all instances of Apache Camel K, confirming their reachability and criticality, and then locating the accountable owner for remediation planning.

Platform and application owners should lead remediation.
Verify Camel K instances and their exposure.
Plan upgrades during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Camel K?

Apache Camel K is a lightweight integration framework built for Kubernetes. It allows developers to run integration code directly on the cluster, using Kubernetes Custom Resources to define and manage how data moves between different applications and services.

How does the CVE-2026-80352 YAML injection work?

This vulnerability is classified as Improper Control of Generation of Code (CWE-94). It allows someone authorized to write Custom Resources to manipulate YAML configurations. By injecting malicious code into these files, an attacker can trick the system into creating unauthorized Kubernetes objects using the elevated permissions of the Camel K operator.

Do I need to be a system administrator to trigger this bug?

You must have authorization to create or modify Custom Resources within the Kubernetes cluster to trigger this issue. Simply interacting with a public-facing application using Camel K is not enough; the attacker needs specific access rights to submit configuration payloads that the operator will process.

Is this Camel K vulnerability risky for my infrastructure?

According to Halo Surface Signal, this vulnerability is classified as external due to its network-based nature. However, because it requires authorized access to author Custom Resources, it is unlikely to be exposed to the public internet in standard setups. You should prioritize this if your Kubernetes environment allows broad user access to create custom resources.

What is the recommended first step to address CVE-2026-80352?

Start by identifying all deployed instances of Apache Camel K within your Kubernetes clusters. Once you have an inventory, coordinate with the platform owners to schedule an upgrade to version 2.9.3, 2.10.2, or 2.11.0, as these versions contain the necessary security fixes for this injection vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.