What is GHSA-q6c4-485h-g4m5?

GHSA-q6c4-485h-g4m5 is a security advisory published by GitHub Security Advisories with Critical severity. Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A...

Which CVE IDs does GHSA-q6c4-485h-g4m5 cover?

GHSA-q6c4-485h-g4m5 covers the following CVE IDs: CVE-2026-80352. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q6c4-485h-g4m5?

GHSA-q6c4-485h-g4m5 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-q6c4-485h-g4m5CriticalCVSS 9.8

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A...

Vendor

GitHub Security Advisories

Published

September 10, 2026

Last Modified

September 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-80352 →

📋 Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K.

A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator.

This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-80352
https://camel.apache.org/security/CVE-2026-80352.html
http://www.openwall.com/lists/oss-security/2026/09/10/15
https://github.com/advisories/GHSA-q6c4-485h-g4m5