Apache Camel Karavan Insecure Deserialization and Privilege Escalation Vulnerability CVE-2026-103413

Vulnerability Overview CVE-2026-103413 Apache Camel Karavan contains an input validation vulnerability. During deployment initiation, Karavan deserializes the project's file and applies all resources to the cluster without restricting resource types, rejecting security-sensitive pod options, or fixing the target namespace. Consequently, any authenticated user with any role can apply arbitrary Kubernetes resources via Karavan, including requesting , , , volumes, host ports, privileged containers, privilege escalation, or containers with added capabilities. Affected Versions Affected Versions: 4.0.0 to 4.22.1 Severity: High Remediation Fixed Version: 4.22.1 Recommended Actions: - Upgrade to version 4.22.1, which resolves this issue. - Ensure that PodSecurity admission control is enforced in the namespace where Karavan is deployed. - Maintain service account RBAC permissions at the minimum required for Karavan. Additional Information Release Date: October 7, 2026 Discoverer: MopMonk-AI References: - CVE-2026-103413.txt.asc - GitHub Commit Notes Resources read from the project's file are now validated before being applied. The type of each item must be listed in (e.g., Deployment, Service, ConfigMap, Secret, Ingress). Pod specifications requesting , , , volumes, host ports, privileged containers, privilege escalation, or added capabilities will be rejected. The namespace of each applied resource is fixed to Karavan's own namespace, regardless of the declaration in the file. Service account RBAC has also been tightened in the reference installation manifests. This validation limits the cluster content that project files can request; it does not serve as a sandbox for user-written deployment artifacts. The Karavan security model continues to treat authenticated users as trusted deployment operators.

Goal Reached Thanks to every supporter — we hit 100%!

Apache Camel Karavan Insecure Deserialization and Privilege Escalation Vulnerability CVE-2026-103413