Eval Injection in Apache Camel K Maven Configuration

Apache Camel K versions 2.0.0 through 2.9.2 and 2.10.1 contain a critical eval injection vulnerability (CVE-2026-80351, CVSS 9.8) in how Maven configurations are dynamically evaluated. The flaw allows tenant-controlled repository content to inject arbitrary directives into code execution contexts, granting attackers the ability to execute code with operator pod privileges. This is particularly dangerous in multi-tenant Kubernetes environments where Camel K operators manage integrations across isolated namespaces. Any organization deploying affected versions faces immediate risk of lateral movement, data exfiltration, and complete cluster compromise, as the operator's elevated permissions become a pivot point for enterprise-wide attacks.

While MITRE ATT&CK techniques are not formally mapped to this CVE, the exploitation pattern aligns with code injection and execution methods. Casky.ai's platform, though currently showing zero matching skills for this specific vulnerability, would typically detect such attacks by analyzing unsafe code evaluation patterns, untrusted input flows into dynamic execution contexts, and privilege escalation chains. A practitioner using Casky would investigate findings around CWE-95 violations by tracing Maven dependency resolution processes, examining operator pod logs for unexpected code instantiation, and identifying where tenant-supplied repository URLs bypass input validation. Security teams should immediately audit their Camel K deployments, apply patches to versions 2.9.3 or 2.10.2+, and implement network policies restricting operator access to only trusted Maven repositories.