Apache Camel K: YAML injection in custom resources creates arbitrary Kubernetes objects as the operator

Impact

A user who can author a Camel K custom resource can inject arbitrary Kubernetes objects into the manifest the operator renders, and those objects are created with the operator's service account privileges. Camel K operators are typically granted broad create rights across their namespaces or cluster-wide, so this turns namespaced CR-author access into resource creation the author was never authorized for - including pods with host mounts or privileged security contexts on GPU nodes if the operator's role permits it. It is a namespace-boundary escape on any shared cluster where tenants can submit integrations.

Who can reach it

Any user authorized to create or edit Camel K custom resources in a namespace the operator watches. Authenticated Kubernetes API access is required; no cluster-admin.

What to do

Upgrade Camel K to 2.9.3, 2.10.2 or 2.11.0 (affected: 2.0.0 before 2.9.3, and 2.10.1 before 2.10.2) - this is an operator deployment rollout, no node disruption. Until then, restrict RBAC on Camel K CRs to trusted principals and tighten the operator's own service account to the minimum resource types it needs.

References

Related entries

• JFrog Artifactory: unauthenticated network attacker can obtain administrative privilegesCVE-2026-82329 · JFrog Artifactory (authentication weakness under default configuration)Critical
• IBM Instana Agent Operator: a same-named CR in any namespace overwrites or deletes the shared ClusterRoleBindingCVE-2026-19274 · IBM Instana Agent Operator (cluster-scoped RBAC objects keyed by bare CR name)Critical
• Argo CD: read-only users can extract plaintext Kubernetes Secret data via ServerSideDiffCVE-2026-42880 · Argo CD API server (ServerSideDiff endpoint)Critical
• Kata Containers: kata-runtime host code execution via an untrusted input pathCVE-2026-50540 · Kata ContainersCritical
• Kyverno: namespaced mutating policy can generate resources into any namespaceCVE-2026-54523 · Kyverno admission controller (NamespacedMutatingPolicy CEL generator library)Critical
• bank-vaults vault-secrets-webhook (vault-addr / vault-serviceaccount pod annotations): parseVaultConfig() honours aCVE-2026-54725 · bank-vaults vault-secrets-webhook (vault-addr / vault-serviceaccount pod annotations)Critical