Apache Camel Karavan: Improper input validation in Kubernetes deployment
Summary
Apache Camel Karavan versions 4.0.0 to before 4.22.1 apply every resource from a project's kubernetes.yaml to the cluster without restricting kinds, pod security options or namespace. An authenticated user of any role can therefore create resources such as privileged pods, pods using hostNetwork, hostPID, hostIPC or hostPath, within the reach of Karavan's service account. Exploitation requires a valid Karavan account, and the risk depends on how Karavan authenticates users and how much RBAC the service account holds.
Affected
- Apache Camel Karavan from 4.0.0 before 4.22.1
Fixed in
- Upgrade to Apache Camel Karavan 4.22.1 (the only release with the fix; no maintenance branches)
Workaround
- No vendor workaround. Enforce PodSecurity admission on the namespace Karavan deploys into.
- Keep the Karavan service account's RBAC no wider than required.
- Restrict who can start deployments.
Exploitation
- Not confirmed exploited in the wild.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found.
Our recommendation
- Upgrade Karavan to 4.22.1 or later and confirm the fix commit a773db37 is included.
- Until patched, limit Karavan accounts to trusted operators and check that Karavan is not reachable from the internet.
- Review the service account's permissions and enforce PodSecurity admission in the target namespace.
- Check existing project kubernetes.yaml files for unexpected resources and monitor the cluster for privileged or host-level pods.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Camel security advisory CVE-2026-103413 camel.apache.org
- Fix commit a773db37 in camel-karavan github.com
- oss-security advisory CVE-2026-103413 www.openwall.com
- OSV entry CVE-2026-103413 osv.dev
- Karavan release 4.22.1 github.com
- Apache mailing list thread (release 4.22.1) lists.apache.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:56.
Original description (NVD)
Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan apply arbitrary Kubernetes resources within the reach of its service account, including pods requesting hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation or added capabilities. This issue affects Apache Camel Karavan: from 4.0.0 before 4.22.1. Users are recommended to upgrade to version 4.22.1, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.