CVE-2026-45760

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45760", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-05-13T07:38:04.636Z", "datePublished": "2026-05-21T11:43:44.844Z", "dateUpdated": "2026-05-23T02:17:48.106Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://hub.docker.com", "defaultStatus": "unaffected", "packageName": "apache/camel-k", "product": "Apache Camel K", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.8.1", "status": "affected", "version": "2.0.0", "versionType": "semver"}, {"lessThan": "2.9.2", "status": "affected", "version": "2.9.0", "versionType": "semver"}, {"lessThan": "2.10.1", "status": "affected", "version": "2.10.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "@j311yl0v3u (2439839508@qq.com)"}, {"lang": "en", "type": "finder", "value": "@b0b0haha (603571786@qq.com)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.</p><p>This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.</p><p>Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.</p>"}], "value": "(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.\n\nThis issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.\n\nUsers are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-610", "description": "CWE-610 (Externally Controlled Reference to a Resource in Another Sphere)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 (Authorization Bypass Through User-Controlled Key)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-05-21T11:43:44.844Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://camel.apache.org/security/CVE-2026-45760.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Camel K: Camel K Cross-Namespace Build Deputy Attack", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/21/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-21T18:37:31.227Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-23T02:15:43.714371Z", "id": "CVE-2026-45760", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-23T02:17:48.106Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-45760", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-23T02:15:43.714371Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-23T02:17:43.097Z"}}], "cna": {"title": "Apache Camel K: Camel K Cross-Namespace Build Deputy Attack", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "@j311yl0v3u (2439839508@qq.com)"}, {"lang": "en", "type": "finder", "value": "@b0b0haha (603571786@qq.com)"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Camel K", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.8.1", "versionType": "semver"}, {"status": "affected", "version": "2.9.0", "lessThan": "2.9.2", "versionType": "semver"}, {"status": "affected", "version": "2.10.0", "lessThan": "2.10.1", "versionType": "semver"}], "packageName": "apache/camel-k", "collectionURL": "https://hub.docker.com", "defaultStatus": "unaffected"}], "references": [{"url": "https://camel.apache.org/security/CVE-2026-45760.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.\n\nThis issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.\n\nUsers are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.</p><p>This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.</p><p>Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-610", "description": "CWE-610 (Externally Controlled Reference to a Resource in Another Sphere)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 (Authorization Bypass Through User-Controlled Key)"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-05-21T11:43:44.844Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45760", "state": "PUBLISHED", "dateUpdated": "2026-05-21T18:37:31.227Z", "dateReserved": "2026-05-13T07:38:04.636Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-05-21T11:43:44.844Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://hub.docker.com", "defaultStatus": "unaffected", "packageName": "apache/camel-k", "product": "Apache Camel K", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.8.1", "status": "affected", "version": "2.0.0", "versionType": "semver"}, {"lessThan": "2.9.2", "status": "affected", "version": "2.9.0", "versionType": "semver"}, {"lessThan": "2.10.1", "status": "affected", "version": "2.10.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.\n\nThis issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.\n\nUsers are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue."}, {"lang": "es", "value": "(Referencia a un Recurso Controlada Externamente en Otra Esfera), (Omisi\u00f3n de Autorizaci\u00f3n Mediante Clave Controlada por el Usuario) vulnerabilidad en Apache Camel K. Usuarios autorizados en un espacio de nombres de Kubernetes pueden crear un recurso Build, controlando la generaci\u00f3n de Pods en un espacio de nombres de su elecci\u00f3n, incluyendo el espacio de nombres del operador.\n\nEste problema afecta a Apache Camel K: desde 2.0.0 anterior a 2.8.1, desde 2.9.0 anterior a 2.9.2, desde 2.10.0 anterior a 2.10.1.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.10.1 (o 2.8.1 o 2.9.2), que corrige el problema."}], "id": "CVE-2026-45760", "lastModified": "2026-07-23T16:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45760", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-23T02:15:43.714371Z", "version": "2.0.3"}}]}, "published": "2026-05-21T13:16:19.840", "references": [{"source": "security@apache.org", "url": "https://camel.apache.org/security/CVE-2026-45760.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/05/21/8"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-610"}, {"lang": "en", "value": "CWE-639"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.8.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.9.0,2.9.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.10.0,2.10.1)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 92.0, "source": "matching"}]}, "original": {"product": "Apache Camel K", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "camel", "vendor": "apache"}], "created": "2026-05-21T13:30:11.213364+00:00", "updated": "2026-05-23T04:30:09.262409+00:00", "vendors": ["apache", "apache$PRODUCT$camel"]}