CVE-2026-45760

Vulnerability

Apache Camel K versions 2.0.0 through 2.8.0, 2.9.0 through 2.9.1, and 2.10.0 are affected by an externally controlled reference and authorization bypass vulnerability [1]. A user authenticated to a Kubernetes namespace can craft a Build resource that specifies a target namespace for Pod generation, including the operator namespace, thereby bypassing intended namespace isolation [1].

Exploitation

An authenticated Kubernetes user with permission to create Build resources in at least one namespace can launch this attack. By setting a non-null cross-namespace reference in the Build spec, the attacker triggers Pod creation in an arbitrary namespace (e.g., camel-k-operator), bypassing standard namespace-scoped RBAC controls. No additional privileges beyond the ability to create Builds are required [1].

Impact

Successful exploitation permits the attacker to control Pod generation in a namespace outside their authorized scope, including the operator namespace. This can lead to privilege escalation, arbitrary code execution in the operator's security context, and compromise of cluster-wide resources managed by the Camel K operator [1].

Mitigation

The vulnerability is fixed in Camel K versions 2.8.1, 2.9.2, and 2.10.1, released 2026-05-21 [1]. Users running any affected version should upgrade immediately to the appropriate fixed release. No workaround is documented for older versions; upgrading is the only advised mitigation [1].