CVE-2026-45760: Apache Camel K: Camel K Cross-Namespace Build Deputy Attack
(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace. This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45760?
CVE-2026-45760 has a severity rating of 30.
How do I fix CVE-2026-45760?
To fix CVE-2026-45760, update Apache Camel K to the latest version where this vulnerability is addressed.
What type of vulnerability is CVE-2026-45760?
CVE-2026-45760 is classified as an Authorization Bypass Through User-Controlled Key vulnerability.
Who is affected by CVE-2026-45760?
Authorized users within a Kubernetes namespace are affected by CVE-2026-45760.
What impact does CVE-2026-45760 have on security?
CVE-2026-45760 allows an attacker to control Pod generation in another namespace, leading to potential unauthorized resource manipulation.