Apache Camel Karavan Patch Fixes High-Severity Kubernetes Privilege Escalation

Apache Software Foundation has released a security update for Apache Camel Karavan to address a high-severity improper input validation vulnerability that could lead to privilege escalation in Kubernetes clusters. The flaw, tracked as CVE-2026-103413, allowed any authenticated user to apply arbitrary Kubernetes resources without restriction, potentially granting attackers control over host-level network and process namespaces.

The vulnerability existed because Karavan failed to validate the contents of a project's `kubernetes.yaml` file during deployment. When a deployment was initiated, the application unmarshalled the file and applied every resource it contained to the cluster. This process lacked safeguards to restrict resource kinds, reject security-sensitive pod options, or pin the target namespace. Consequently, an authenticated user of any role could leverage the service account’s permissions to deploy pods with dangerous configurations. These included requests for `hostNetwork`, `hostPID`, `hostIPC`, `hostPath` volumes, host ports, privileged containers, privilege escalation, and added capabilities.

Technical Context and Severity

According to the National Vulnerability Database (NVD), CVE-2026-103413 is assigned a CVSS 3.1 score of 8.8, which is classified as high severity. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that the attack can be launched remotely with low complexity and requires only low privileges, without user interaction. The weakness is categorized under CWE-20, which covers improper input validation.

Andrea Cosentino posted the advisory to the oss-security mailing list on October 9, 2026. The advisory highlights that the lack of validation on the `kubernetes.yaml` file meant that the application effectively acted as an unrestricted conduit for applying Kubernetes manifests. This bypassed standard security controls that would normally prevent the creation of resources with elevated privileges or access to host-level resources.

Affected Versions and Remediation

The vulnerability affects Apache Camel Karavan versions starting from 4.0.0 up to, but not including, 4.22.1. Users running any version within this range are susceptible to the issue. The Apache Software Foundation recommends that all users upgrade to version 4.22.1 immediately. This specific update fixes the improper input validation by implementing necessary restrictions on resource kinds and rejecting security-sensitive pod options during the deployment process.

What should you do?

Administrators and security engineers should verify their current installation of Apache Camel Karavan against the affected version range. If the installed version is prior to 4.22.1, they should apply the update as soon as possible to mitigate the risk of unauthorized resource deployment. Organizations should also review their Kubernetes audit logs for any unusual resource creations or pods with privileged settings that may indicate exploitation of this vulnerability.