Camel K critical flaw lets tenants run code as the operator
CVE-2026-80351 turns tenant-controlled Maven repositories into arbitrary code execution inside the Camel K operator pod.
Apache Camel K contains a critical eval injection flaw that can let a tenant run arbitrary code with the privileges of the operator.
Tracked as CVE-2026-80351, the bug stems from improper neutralization of directives in dynamically evaluated Maven configuration. Tenant-controlled repository content can thereby influence code execution inside the operator pod, breaking isolation in multi-tenant deployments where untrusted users share a privileged operator.
The issue affects Apache Camel K from 2.0.0 before 2.9.3, and from 2.10.1 before 2.10.2. Fixed releases are 2.9.3, 2.10.2, and 2.11.0. Pasquale Congiusti reported the vulnerability on the oss-security list and urged upgrades.