CVE-2026-45760 json
Apache Camel K: Camel K Cross-Namespace Build Deputy Attack
published 2026-05-21 5 mo ago modified 2026-07-23 3 mo ago also EUVD-2026-31268 , GHSA-q8ch-jx67-q52x , GO-2026-5573
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.
This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.
Patch / fix
- go github.com/apache/camel-k/v2 2.8.1, 2.9.2, 2.10.1
- Apache Software Foundation Apache Camel K 2.8.1, 2.9.2, 2.10.1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
- github.com/apache/camel-k@1271df0 commit
- github.com/apache/camel-k@1efa398 commit
- github.com/apache/camel-k@35dd387 commit
- github.com/apache/camel-k#6626 pull request
- github.com/apache/camel-k#6627 pull request
- github.com/apache/camel-k#6629 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/apache/camel-k/v2 | <2.8.1 >=2.9.0, <2.9.2 >=2.10.0, <2.10.1 |
2.8.1 2.9.2 2.10.1 |
| go | github.com/apache/camel-k | all versions |
no fix listed |
Affected products
- Apache Software Foundation Apache Camel K
Classification
References
-
github.com
/apache/camel-k/pull/6626
web, patch
-
github.com
/apache/camel-k/pull/6627
web, patch
-
github.com
/apache/camel-k/pull/6629
web, patch
-
github.com
/apache/camel-k/commit/1271df076f3123f5e4ec58e066e284236b1a8fb5
web, patch
-
github.com
/apache/camel-k/commit/1efa3982f4dbce0ae1f896f4003a16cae6d81ba2
web, patch
-
github.com
/apache/camel-k/commit/35dd387f58464608ab4764f67bde786cf09bc39d
web, patch
-
camel.apache.org
/security/CVE-2026-45760.html
vendor-advisory, web
-
openwall.com
/lists/oss-security/2026/05/21/8
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-45760
advisory
-
github.com
/apache/camel-k
package
-
github.com
/advisories/GHSA-q8ch-jx67-q52x
advisory
Sources
- CVE List CVE-2026-45760
- GitHub Advisory GHSA-q8ch-jx67-q52x
- NVD CVE-2026-45760
- OSV GO-2026-5573
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.