CVE-2026-103413

HighCVSS 8.8

Published: 09/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

Improper input validation vulnerability in Apache Camel Karavan. When a deployment is started, Karavan applies all resources from kubernetes.yaml without restricting resource kinds, security-sensitive pod options, or namespace.

Risk Assessment

An authenticated user of any role can apply arbitrary Kubernetes resources within the service account's reach, including pods with host privileges, potentially leading to privilege escalation or cluster compromise.

Recommendation

Upgrade Apache Camel Karavan to version 4.22.1 or later, which fixes the issue.

Other vulnerabilities in Apache Camel Karavan

CVE-2026-103412High
Path traversal vulnerability in Apache Camel Karavan. A project file name supplied via the API is used verbatim as a path segment, allowing file writes outside the project directory to any writable location.

Original NVD description (English source)

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan apply arbitrary Kubernetes resources within the reach of its service account, including pods requesting hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation or added capabilities. This issue affects Apache Camel Karavan: from 4.0.0 before 4.22.1. Users are recommended to upgrade to version 4.22.1, which fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS