CVE-2026-80354

Summary

Authorization bypass through User-Controlled key vulnerability in Apache Camel K.

An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components.

This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

Affected Software

Weaknesses

• CWE-639: CWE-639 Authorization bypass through User-Controlled key

ADP Enrichment

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2026/09/10/16

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://camel.apache.org/security/CVE-2026-80354.html

• ←Previous
• Next→