« Volver al listado

CVE-2026-45760

Estado: AplazadaAlta (8.1)—

(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.

This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.

Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad remota en Apache Camel K explotable por usuarios autenticados (PR:L) sin interacción. Permite crear recursos Build en namespace del operador, escalando privilegios en Kubernetes y derivando en acceso administrativo (I:H, C:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningPrivileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Apache — Camel KAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-45760",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45760",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-23T02:15:43.714371Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Camel K",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.8.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.9.0",
              "lessThan": "2.9.2",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.10.0",
              "lessThan": "2.10.1",
              "versionType": "semver"
            }
          ],
          "packageName": "apache/camel-k",
          "collectionURL": "https://hub.docker.com",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-05-21T13:16:19.840",
  "references": [
    {
      "url": "https://camel.apache.org/security/CVE-2026-45760.html",
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/21/8",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-610"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.\n\nThis issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.\n\nUsers are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue."
    },
    {
      "lang": "es",
      "value": "(Referencia a un Recurso Controlada Externamente en Otra Esfera), (Omisión de Autorización Mediante Clave Controlada por el Usuario) vulnerabilidad en Apache Camel K. Usuarios autorizados en un espacio de nombres de Kubernetes pueden crear un recurso Build, controlando la generación de Pods en un espacio de nombres de su elección, incluyendo el espacio de nombres del operador.\n\nEste problema afecta a Apache Camel K: desde 2.0.0 anterior a 2.8.1, desde 2.9.0 anterior a 2.9.2, desde 2.10.0 anterior a 2.10.1.\n\nSe recomienda a los usuarios actualizar a la versión 2.10.1 (o 2.8.1 o 2.9.2), que corrige el problema."
    }
  ],
  "lastModified": "2026-07-23T16:10:00.137",
  "sourceIdentifier": "security@apache.org"
}