CVE-2026-103413

Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml

State: Published
Severity: 8.8 High
Published: Oct 9, 2026
Updated: Oct 15, 2026
Reserved: Sep 30, 2026

Description

Improper input validation vulnerability in Apache Camel Karavan.

When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan apply arbitrary Kubernetes resources within the reach of its service account, including pods requesting hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation or added capabilities.

This issue affects Apache Camel Karavan: from 4.0.0 before 4.22.1.

Users are recommended to upgrade to version 4.22.1, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	apache

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Apache Camel KaravanApache Software Foundation	4.0.0 to before 4.22.1Affected

References

Apache Camel Karavan Security Advisory - CVE-2026-103413vendor-advisory
Fix commitpatch
http://www.openwall.com/lists/oss-security/2026/10/09/17

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.