CVE-2026-45760 involves an externally controlled reference to a resource in another sphere (CWE-610) and an authorization bypass through a user-controlled key (CWE-639) in Apache Camel K. Specifically, authorized users in a Kubernetes namespace can create Build resources that influence Pod creation in namespaces beyond their own, including the operator namespace. This could lead to unauthorized control over Pod generation and potentially escalate privileges or disrupt operations. The vulnerability affects multiple versions of Apache Camel K prior to the patched releases 2.8.1, 2.9.2, and 2.10.1.

The vulnerability allows an authorized user in one Kubernetes namespace to manipulate Pod creation in other namespaces, including the operator namespace, potentially leading to unauthorized privilege escalation or interference with operator-managed resources. The CVSS score of 8.1 indicates high impact on confidentiality and integrity, with no impact on availability. There are no known exploits in the wild at this time.

Users should upgrade Apache Camel K to version 2.10.1, 2.9.2, or 2.8.1, which contain fixes for this vulnerability. Patch status is not explicitly stated as 'official-fix' in the vendor advisory content, but the recommendation to upgrade to these versions indicates that a fix is available. No additional mitigation steps are specified or required beyond applying the upgrade.