{"id":"CVE-2026-103413","published":"2026-10-09T13:17:07.633","lastModified":"2026-10-15T19:17:13.957","description":"Improper input validation vulnerability in Apache Camel Karavan.\n\n\n\nWhen a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan apply arbitrary Kubernetes resources within the reach of its service account, including pods requesting hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation or added capabilities.\n\n\n\nThis issue affects Apache Camel Karavan: from 4.0.0 before 4.22.1.\n\n\n\nUsers are recommended to upgrade to version 4.22.1, which fixes the issue.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://camel.apache.org/security/CVE-2026-103413.html","tags":[]},{"url":"https://github.com/apache/camel-karavan/commit/a773db372eab9f180110ad6129d58004a1bce571","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/17","tags":[]}],"exploitRefs":[{"url":"https://github.com/apache/camel-karavan/commit/a773db372eab9f180110ad6129d58004a1bce571","tags":[]}],"hasPoc":true,"ai":{"summary":"Apache Camel Karavan contains an improper input validation vulnerability that allows authenticated users to deploy arbitrary Kubernetes resources without restrictions on resource kinds or security-sensitive pod configurations. This enables attackers to create privileged containers, access host resources, and escalate privileges within the cluster.","exploitability":"Exploitation is relatively straightforward for authenticated users who can trigger a deployment, requiring only basic access to Karavan's deployment functionality with no additional prerequisites.","blast_radius":"The impact could be severe as attackers could gain full cluster control by deploying privileged pods with host access, privilege escalation capabilities, and arbitrary resource creation within the service account's namespace scope.","remediation":"Upgrade to version 4.22.1 which fixes the improper input validation in Karavan's Kubernetes resource handling.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kubernetes","privilege-escalation","rce","config-injection"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:50:55.365Z"}}