Apache Camel K Cross-Namespace Build Resource Control Vulnerability

An authorization bypass vulnerability allowing externally controlled references to resources in another sphere has been identified in Apache Camel K. This issue affects authorized users in a Kubernetes namespace who can create Build resources, thereby controlling Pod generation in any namespace, including the operator namespace. The vulnerability is present in Apache Camel K versions 2.0.0 prior to 2.8.1, 2.9.0 prior to 2.9.2, and 2.10.0 prior to 2.10.1.

Impact

Exploitation of this vulnerability allows for unauthorized control over Pod generation in selected namespaces, potentially including the operator namespace.

Remediation

Users are advised to upgrade to Apache Camel K versions 2.10.1, 2.8.1, or 2.9.2, all of which address this vulnerability.