CVE-2026-80354

HighCVSS 8.1/10Last modified Sep 14, 2026

Description

Authorization bypass through User-Controlled key vulnerability in Apache Camel K.

An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components.

This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Camel K	>= 2.0.0, < 2.9.3; >= 2.10.1, < 2.10.2

References

https://camel.apache.org/security/CVE-2026-80354.htmlVendor Advisory, Patch
http://www.openwall.com/lists/oss-security/2026/09/10/16Mitigation, Third Party Advisory

Timeline

Published: Sep 10, 2026
Last modified: Sep 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-803555.4Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthentic CVE-2026-803567.3Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vul CVE-2026-803577.0Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access CVE-2026-803585.1Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access CVE-2026-803596.8Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access CVE-2026-80367.8Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege CVE-2026-80379.8OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbi CVE-2026-803786.5IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authori CVE-2026-803798.8IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutra CVE-2026-80386.4The Faces of Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in the 'facesofus CVE-2026-803807.1IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery.CVE-2026-803819.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.