Read the docs
TI-2026-70022 Aliases CVE-2026-103413GHSA-5c9w-j8c6-h6m2

Unvalidated Kubernetes resources applied by Apache Camel Karavan

Priority MEDIUM 40CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Apache Camel Karavan from 4.0.0 before 4.22.1 applies every resource in a project's kubernetes.yaml to the cluster when a deployment starts, without restricting resource kinds, rejecting security-sensitive pod options or pinning the target namespace. This is an improper input validation flaw (CWE-20). An authenticated user with any role can have Karavan create pods that request host networking, host PID or IPC, host paths, privileged containers or added capabilities, within the reach of Karavan's service account.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan apply arbitrary Kubernetes resources within the reach of its service account, including pods requesting hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation or added capabilities. This issue affects Apache Camel Karavan: from 4.0.0 before 4.22.1. Users are recommended to upgrade to version 4.22.1, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Fixed Apache Camel Karavan (Apache Software Foundation): 4.22.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Camel Karavan4.0.0 to before 4.22.14.22.1Patch availableCNA
  • Apache Camel Karavan VendorApache Affected 4.0.0 to before 4.22.1 Fixed in 4.22.1 Patch available CNA

Remediation

Upgrade Apache Camel Karavan to version 4.22.1, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Apache Camel Karavan (Apache Software Foundation) Fixed in 4.22.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Camel Karavan 4.22.1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-70021 Path traversal in Apache Camel Karavan lets users write files outside projectsPriority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-103413
  2. 2026-10-09 Alias added: GHSA-5c9w-j8c6-h6m2
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-16 CISA SSVC decision points changed
  5. 2026-10-16 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences