Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-10T08:16:59.070Z",
  "pubdate": "2026-09-10T08:16:59.070Z",
  "executiveSummary": "Apache Camel K contains a critical Code Injection vulnerability identified as improper control of generation of code. The vulnerability exists within the custom resource configuration parsing logic, allowing an authorized Custom Resource (CR) author to inject arbitrary Kubernetes objects.\nThis flaw enables an attacker to manipulate the deployment process, leading to the unauthorized creation or modification of Kubernetes resources. Because these objects are created with the elevated privileges of the Camel K operator, the impact is significant, potentially leading to full cluster compromise or unauthorized access to sensitive data.\nThe vulnerability affects Apache Camel K versions 2.0.0 through 2.8.x (prior to 2.9.3) and versions 2.10.1 (prior to 2.10.2). Exploitation requires the attacker to have sufficient permissions to create or update Custom Resources within the Kubernetes environment.\nRisk implications include potential privilege escalation and unauthorized manipulation of the orchestration layer. Users are urged to apply the recommended version updates immediately to neutralize this injection vector.",
  "technicalDetails": "The vulnerability stems from improper validation and sanitization of YAML configurations processed by the Apache Camel K operator. When the operator processes Custom Resource (CR) definitions, it fails to sufficiently constrain the input provided by the CR author. This lack of strict schema enforcement allows for a YAML injection attack, where an attacker can supply malicious YAML structures that the operator interprets as legitimate configuration instructions.\nIn a standard deployment, the Camel K operator is granted significant Kubernetes RBAC permissions to facilitate the management of Integrations and related resources. By injecting arbitrary Kubernetes objects into the CR configuration, an attacker can coerce the operator into creating resources that the attacker would otherwise be unauthorized to manage. For instance, an attacker could inject YAML snippets that define high-privilege ServiceAccounts, ClusterRoles, or pods mounted with sensitive volume secrets.\nThe attack flow proceeds as follows: First, an authorized user (the CR author) crafts a malicious YAML payload embedded within a Custom Resource definition. Second, this CR is submitted to the Kubernetes API server. Third, the Camel K operator, acting with its elevated service account privileges, retrieves and parses the malicious YAML. Fourth, because the parsing logic does not sanitize the input, the injected objects are processed and instantiated within the cluster. Finally, the operator, acting as the 'confused deputy,' creates the attacker-specified resources, effectively bypassing standard namespace or role-based access control restrictions.\nThis vulnerability is classified as an improper control of generation of code (CWE-94 equivalent). The affected component is the operator's CRD configuration processor. Affected versions include 2.0.0 before 2.9.3, and 2.10.1 before 2.10.2. The exploitation is facilitated by the operator's high-privilege context, which remains a core feature of its functionality. Therefore, the primary defense is the implementation of strict input validation within the operator to ensure that parsed YAML content adheres to expected schemas and cannot include arbitrary Kubernetes resource definitions or unintended object types."
}