CVE-2026-103413: CWE-20 Improper Input Validation in Apache Software Foundation Apache Camel Karavan

CVE-2026-103413 describes an improper input validation vulnerability (CWE-20) in Apache Camel Karavan. When starting a deployment, Karavan unmarshals the project's kubernetes.yaml and applies all contained Kubernetes resources to the cluster without restricting resource kinds, rejecting security-sensitive pod options, or pinning the target namespace. This allows any authenticated user, regardless of role, to cause Karavan to apply arbitrary Kubernetes resources within the service account's reach, including potentially dangerous pod configurations. The vulnerability affects versions >=4.0.0 and <4.22.1 and is resolved in version 4.22.1.

An attacker with any authenticated role can exploit this vulnerability to deploy arbitrary Kubernetes resources with potentially elevated privileges or sensitive configurations. This can lead to full compromise of the Kubernetes cluster environment accessible by Karavan's service account, including privilege escalation, host resource access, and disruption of cluster operations. The CVSS 3.1 score is 8.8 (High), reflecting the network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Users should upgrade Apache Camel Karavan to version 4.22.1 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating the fix in 4.22.1.