VulnSocial

CVE-2026-80352Patch(apache / camel)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache camel systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • camel

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 1 classified signal
  • Peaked 4d ago at 1 mentions (2026-09-11); latest day: 1
  • 5 total mentions across 5 days

Affected systems

Vendors
apache
Products
camel

Deep dive

Activity timeline5 mentions / 5d
00111Mentions · 2026-09-11: 1Mentions · 2026-09-13: 1Mentions · 2026-09-14: 1Mentions · 2026-09-28: 1Mentions · 2026-10-26: 1Patch / Workaround · 2026-09-11: 1Patch / Workaround · 2026-09-13: 1Patch / Workaround · 2026-09-14: 1Technical Details · 2026-09-11: 1Technical Details · 2026-09-13: 1Technical Details · 2026-09-14: 1Technical Details · 2026-09-28: 109-1109-1309-1409-2810-26
Signal classification2 categories
Patch
375.0%
Disclosure
125.0%
Referenced assets12 URLs
Classification over time
DateTotalLabels
2026-09-111
Patch1
2026-09-131
Patch1
2026-09-141
Patch1
2026-09-281
Disclosure1
Full discourse5 posts
  • ThreatWire@ThreatWire_

    🚨 A failed OAuth check in Apache Camel could still let the request through (CVE-2026-80312). One of 8 Camel/Camel K flaws, incl. unsafe deserialization. Fix: Camel 4.18.5/4.22.1/4.23.0, Camel K 2.9.3/2.10.2/2.11.0. Disclosed 8 Sep–19 Oct 2026. Breakdown: https://www.threatwire.tech/news/apache-camel-and-camel-k-fix-eight-high-and-critical-flaws-oauth-bypass-deserialization-rce CVE-2026-80352 https://www.threatwire.tech/cve/cve-2026-80352 CVE-2026-80351 https://www.threatwire.tech/cve/cve-2026-80351 CVE-2026-88900 https://www.threatwire.tech/cve/cve-2026-88900 [CVE-2026-78165 https://www.threatwire.tech/cve/cve-2026-78165 [CVE-2026-80312 https://www.threatwire.tech/cve/cve-2026-80312 CVE-2026-78164 https://www.threatwire.tech/cve/cve-2026-78164 CVE-2026-85251 https://www.threatwire.tech/cve/cve-2026-85251 CVE-2026-88901 https://www.threatwire.tech/cve/cve-2026-88901

    00023247
    2.0K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Three critical Apache Camel K vulnerabilities, including CVE-2026-80352, allow code injection and eval injection. Patch these critical flaws immediately. #ApacheCamel #CamelK #Cybersecurity #CVE202680352 #InfoSec https://securityonline.info/apache-camel-k-vulnerabilities/

    Post summary

    The post highlights three critical Apache Camel K vulnerabilities, provides technical details of code and eval injection flaws, and urges immediate patching, focusing primarily on remediation.

    00020485
    13.0K followersView on X
  • 0x870x4k3r@pepetheshneine
    Disclosure

    6/7 Apache Camel K has its own trust-boundary problem. CVE-2026-80351: tenant-controlled Maven repos can reach execution inside the operator pod. CVE-2026-80352: YAML injection can let a CR author apply arbitrary Kubernetes objects. Tenant -> operator is a nasty jump.

    Post summary

    The text discloses two CVEs in Apache Camel K, highlighting trust-boundary vulnerabilities that allow tenant-controlled Maven repos and YAML injection to reach operator pods and Kubernetes resources. Technical details about the vulnerability types are clearly described, but no patches or exploits are referenced.

    1000038
    29 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    ⚗️ Apache Camel K: CVE-2026-80352 is a CVSS 9.8 YAML injection in the Master trait serviceAccountName field, letting a CR author apply arbitrary objects to your cluster. Patch now. #cybersecurity #ciso #cto #vulnerabilities #msp https://secalerts.co/vulnerability/CVE-2026-80352?utm_campaign=x https://t.co/89iAVw24dd

    Post summary

    CVE‑2026‑80352 is a high‑severity YAML injection vulnerability in Apache Camel K that permits attackers to deploy arbitrary objects, and a patch is now available.

    1000098
    890 followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: 2 critical #Apache #CamelK flaws allow tenants & CR authors to act with the operator's privileges! CVE-2026-80351 & CVE-2026-80352 CVSS(3.1): 9.8. #RCE Patch to 2.9.3, 2.10.2 or 2.11.0 now! https://camel.apache.org/security/ #Patch #Patch #Patch

    Post summary

    The tweet warns of two critical CamelK vulnerabilities (CVE-2026-80351, CVE-2026-80352) with a CVSS score of 9.8 and urges immediate upgrade to patched versions 2.9.3, 2.10.2, or 2.11.0.

    00000277
    7.2K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachecamel---

Explore more

Back to dashboardapache CVEscamel vulnerabilities