CVE-2026-80351

EUVD-2026-75291

10.09.2026, 08:16

Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K.

An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator.

This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0, which fixes the issue.

Eval Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 62.97%

Affected Products (NVD)

Vendor	Product	Version
apache	camel	2.0.0 ≤ 𝑥 < 2.9.3
apache	camel	2.10.0 ≤ 𝑥 < 2.10.2

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

References

https://camel.apache.org/security/CVE-2026-80351.html

http://www.openwall.com/lists/oss-security/2026/09/10/14