CVE-2026-80351Patch(apache / camel)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache camel systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://camel.apache.org/security/CVE-2026-80351.html

Vendor / third-party advisories

http://www.openwall.com/lists/oss-security/2026/09/10/14

Weakness type (CWE)

CWE-95

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

camel

Threat summary

Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
Peaked 3d ago at 1 mentions (2026-09-13); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

apache

Products

camel

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

Patch

375.0%

Disclosure

125.0%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-13	1	Patch1
2026-09-14	1	Patch1
2026-09-28	1	Disclosure1
2026-10-26	1	Patch1

Full discourse4 posts

ThreatWire@ThreatWire_2d
Patch
🚨 A failed OAuth check in Apache Camel could still let the request through (CVE-2026-80312). One of 8 Camel/Camel K flaws, incl. unsafe deserialization. Fix: Camel 4.18.5/4.22.1/4.23.0, Camel K 2.9.3/2.10.2/2.11.0. Disclosed 8 Sep–19 Oct 2026. Breakdown: https://www.threatwire.tech/news/apache-camel-and-camel-k-fix-eight-high-and-critical-flaws-oauth-bypass-deserialization-rce CVE-2026-80352 https://www.threatwire.tech/cve/cve-2026-80352 CVE-2026-80351 https://www.threatwire.tech/cve/cve-2026-80351 CVE-2026-88900 https://www.threatwire.tech/cve/cve-2026-88900 [CVE-2026-78165 https://www.threatwire.tech/cve/cve-2026-78165 [CVE-2026-80312 https://www.threatwire.tech/cve/cve-2026-80312 CVE-2026-78164 https://www.threatwire.tech/cve/cve-2026-78164 CVE-2026-85251 https://www.threatwire.tech/cve/cve-2026-85251 CVE-2026-88901 https://www.threatwire.tech/cve/cve-2026-88901
Post summary
The tweet announces CVE-2026-80312 and related Camel/Camel K flaws, lists specific patched versions as the fix, and provides links for further details.
00023247
2.0K followersView on X
0x870x4k3r@pepetheshneine31d
Disclosure
6/7 Apache Camel K has its own trust-boundary problem. CVE-2026-80351: tenant-controlled Maven repos can reach execution inside the operator pod. CVE-2026-80352: YAML injection can let a CR author apply arbitrary Kubernetes objects. Tenant -> operator is a nasty jump.
Post summary
The post discloses two Apache Camel K vulnerabilities (CVE‑2026‑80351 and CVE‑2026‑80352) detailing trust‑boundary issues that could allow tenant‑controlled Maven repositories to execute inside the operator pod and YAML injection to apply arbitrary Kubernetes objects.
1000038
29 followersView on X
SecAlerts@SecAlertsCo46d
Patch
☕ Apache Camel K CVSS 9.8: CVE-2026-80351 allows tenant repos to inject directives into Maven config, executing code inside the operator pod. No auth required. Patch now. #cybersecurity #ciso #cto #vulnerabilities #msp https://secalerts.co/vulnerability/CVE-2026-80351?utm_campaign=x https://t.co/XCwTsF9GA3
Post summary
Apache Camel K CVE‑2026‑80351 permits unauthenticated code execution via tenant repo configuration injection; a patch is now available.
1000093
890 followersView on X
CCB Alert@CCBalert44d
Patch
Warning: 2 critical #Apache #CamelK flaws allow tenants & CR authors to act with the operator's privileges! CVE-2026-80351 & CVE-2026-80352 CVSS(3.1): 9.8. #RCE Patch to 2.9.3, 2.10.2 or 2.11.0 now! https://camel.apache.org/security/ #Patch #Patch #Patch
Post summary
This advisory discloses two critical Apache CamelK vulnerabilities (CVE-2026-80351, CVE-2026-80352) with a CVSS score of 9.8, and explicitly instructs users to patch to versions 2.9.3, 2.10.2, or 2.11.0.
00000277
7.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	camel	-	-	-

Explore more

Back to dashboard apache CVEs camel vulnerabilities

What researchers are saying

CVE-2026-80351

ThreatWire[verified]@ThreatWire_Patch

The tweet announces CVE-2026-80312 and related Camel/Camel K flaws, lists specific patched versions as the fix, and provides links for further details.

0x870x4k3r@pepetheshneineDisclosure

The post discloses two Apache Camel K vulnerabilities (CVE‑2026‑80351 and CVE‑2026‑80352) detailing trust‑boundary issues that could allow tenant‑controlled Maven repositories to execute inside the operator pod and YAML injection to apply arbitrary Kubernetes objects.

SecAlerts@SecAlertsCoPatch

Apache Camel K CVE‑2026‑80351 permits unauthenticated code execution via tenant repo configuration injection; a patch is now available.

CCB Alert@CCBalertPatch

This advisory discloses two critical Apache CamelK vulnerabilities (CVE-2026-80351, CVE-2026-80352) with a CVSS score of 9.8, and explicitly instructs users to patch to versions 2.9.3, 2.10.2, or 2.11.0.