As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-80354: Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace
CVE-2026-80354 is an authorization bypass vulnerability in Apache Camel K affecting versions 2.0.0 through 2.9.3 and 2.10.1 through 2.10.2. The flaw allows tenants to access secrets in the operator namespace through the mavenProfiles ValueSources configuration, potentially exposing sensitive data belonging to other tenants or the operator itself.
Why it matters: Organizations running vulnerable Camel K clusters should upgrade immediately, as multi-tenant deployments face exposure of cross-tenant secrets and operator credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-80354: Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace
An authorization bypass vulnerability in Apache Camel K allows a tenant to access secrets in the operator namespace by name, potentially exposing secrets belonging to other tenants. The vulnerability affects versions 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2. The flaw exists in custom resource resolution where the Builder trait mavenProfiles ValueSources component does not properly restrict secret access.
Why it matters: Operators running multi-tenant Apache Camel K deployments must upgrade immediately to prevent cross-tenant secret disclosure and access to operator infrastructure credentials.
- Source published
- First seen by Cybersecurity Tracker