The vulnerability is an improper control of code generation that allows a YAML injection in custom resource configuration. An authorized creator of a custom resource can inject arbitrary Kubernetes objects, which are then created with the privileges of the operator. This effectively permits configuration, compromising confidentiality, integrity and availability of the cluster.

Apache Camel K from version 2.0.0 up to but not including 2.9.3, from 2.10.1 up to but not including earlier releases are vulnerable. The vulnerability is tied to the Master trait serviceAccountName handling in Camel K custom resources.

The CVSS score of 9.8 indicates critical severity. An attacker who can author a custom resource can inject arbitrary Kubernetes objects that are provisioned with the cluster operator’s service account privileges, allowing execution of malicious workloads or exceeding intended authorization boundaries. The exploitation path requires only the creation of a custom resource, a common permission that CR authors typically hold. The EPSS score of <1% and lack of KEV listing suggest a low likelihood of exploitation, yet the potential impact remains high should an attack occur.