CVE-2026-103413

Summary

Apache Camel Karavan contains an improper input validation vulnerability that allows authenticated users to deploy arbitrary Kubernetes resources without restrictions on resource kinds or security-sensitive pod configurations. This enables attackers to create privileged containers, access host resources, and escalate privileges within the cluster.

Exploitability

Exploitation is relatively straightforward for authenticated users who can trigger a deployment, requiring only basic access to Karavan's deployment functionality with no additional prerequisites.

Blast radius

The impact could be severe as attackers could gain full cluster control by deploying privileged pods with host access, privilege escalation capabilities, and arbitrary resource creation within the service account's namespace scope.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.22.1 which fixes the improper input validation in Karavan's Kubernetes resource handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.