This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-website.git
The following commit(s) were added to refs/heads/main by this push:
new fb479f68 chore(doc): security severity category align (#1759)
fb479f68 is described below
commit fb479f686da3e642e0bcb1b66dc67427fb7d6a5c
Author: Pasquale Congiusti <[email protected]>
AuthorDate: Tue Sep 15 13:42:33 2026 +0200
chore(doc): security severity category align (#1759)
---
content/security/CVE-2026-80354.md | 2 +-
content/security/CVE-2026-80354.txt.asc | 28 ++++++++++++++--------------
2 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/content/security/CVE-2026-80354.md
b/content/security/CVE-2026-80354.md
index bbe993a9..92c123f2 100644
--- a/content/security/CVE-2026-80354.md
+++ b/content/security/CVE-2026-80354.md
@@ -5,7 +5,7 @@ url: /security/CVE-2026-80354.html
draft: false
type: security-advisory
cve: CVE-2026-80354
-severity: MODERATE
+severity: MEDIUM
summary: "Camel K Builder trait mavenProfiles ValueSources resolve
tenant-named secrets in operator namespace"
description: "Authorization bypass through User-Controlled key vulnerability
in Apache Camel K. An authorization vulnerability in custom resource resolution
allows a tenant to reference secrets by name in the operator namespace,
potentially exposing secrets belonging to other tenants or operator components.
This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before
2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0,
which fixes the issue."
mitigation: "Users are recommended to upgrade to version 2.11.0 (or 2.10.2 or
2.9.3), which fixes the issue."
diff --git a/content/security/CVE-2026-80354.txt.asc
b/content/security/CVE-2026-80354.txt.asc
index ba775ed0..8fea3083 100644
--- a/content/security/CVE-2026-80354.txt.asc
+++ b/content/security/CVE-2026-80354.txt.asc
@@ -8,7 +8,7 @@ url: /security/CVE-2026-80354.html
draft: false
type: security-advisory
cve: CVE-2026-80354
-severity: MODERATE
+severity: MEDIUM
summary: "Camel K Builder trait mavenProfiles ValueSources resolve
tenant-named secrets in operator namespace"
description: "Authorization bypass through User-Controlled key vulnerability
in Apache Camel K. An authorization vulnerability in custom resource resolution
allows a tenant to reference secrets by name in the operator namespace,
potentially exposing secrets belonging to other tenants or operator components.
This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before
2.10.2. Users are recommended to upgrade to version 2.9.3, 2.10.2 or 2.11.0,
which fixes the issue."
mitigation: "Users are recommended to upgrade to version 2.11.0 (or 2.10.2 or
2.9.3), which fixes the issue."
@@ -20,17 +20,17 @@ fixed: 2.9.3, 2.10.2 and 2.11.0
The pull requests https://github.com/apache/camel-k/pull/6784 (2.11.x),
https://github.com/apache/camel-k/commit/047e359168c473d88cd3f3f848904255451d284f
(2.10.x) and
https://github.com/apache/camel-k/commit/46b98e7a46575fcbe3e66192d842092047259886
(2.9.x) refer to the commits that resolved the issue, and have more details.
-----BEGIN PGP SIGNATURE-----
-iQIzBAEBCgAdFiEEDV4jKJJJXejlQHXMrtxqiqrKh1YFAmqf/ggACgkQrtxqiqrK
-h1Yl9g//X2wDb8D2MCAbMmP/Py9QMCLlF7zUUSc7+zgmh55GXUVAID3/weOAvZER
-OCt1fRCGcIMiDqC+kdTtB2XH4TzlhFv3V6zPUzURJ+BK2K9wuzHP3Sm9x6DHGF1u
-PJ63e1x4cH3Z0GqXeT2hGskqopzo89N19Utq7Vflnb05ll99wkOyOEh3Ca8Ih9Ex
-ApuwTc3nu0SVIUcfA5x6lbzSVLxAOuROPRNMNbbU178GV77cek9lR3fJY6tydFz7
-NpvyeS3aYrd1YTsR/zYRYOfU2uMQkb4du2IdjSzK7JwD+JPddpkIWWewHszaTP7T
-5lZ6Wv/tD6xGnaxKfvsEEfgrRYSmc9OQnzIw6KyCxr7Pd/LTOxK58SZHhFk8fBi5
-+yRVlVAnKZ3CFTlpXC8CoSFXvTf4pa4/cD3VIEfYYsnQfc8Yr9DnbYTGvARiiqrY
-bITlWF7h9lSMR0cXCAgCzgU2tsdJiUt86AQXlLUYgs3qptCm02bBBftjTg3vEUHl
-pJVCWIz4FRypv7SAWrLgLjHlAHOtZv7vWYQ8vKM7QhaTpe1ZIokvsHrGfKccsU0S
-wZxtMYkeWfeI1fNKz/cLnpITwC/7tqlgkrjft+vsLqqFKc358CXS9c3ue0ueYd7Z
-6QhdSr2WF2rCcwB3fKIuezzo4pxO01QBzXOHommk1jDPI0hECj0=
-=hi70
+iQIzBAEBCgAdFiEEDV4jKJJJXejlQHXMrtxqiqrKh1YFAmqpEnUACgkQrtxqiqrK
+h1brExAAs60dM5FU73Xjsa1yvfKM4LkqQl6TDwRthR9wIrYVE2leMyIs1vG9TjOT
+yfjRH4ZB5bkv5W2pWrJVP1nFsIMyGwRSVBWlo2u4Mv76rTRHKknd0Nhg1jMbpO/d
+eA/TOk085fUV8PvLVgzfTDKSROnwnW//fdwv2+OfdNQzoqq9cBrowvZLZ5OIqcv/
+TURdT38KfJl/2hfLpV2wrEJr7oc3+zkbzkix1grac7JvNCvIoz2R3dDStQ0CB0Go
+2KLLRZ72+DI6mCSbVaGIeL+ZLvTTuvNHdKqUeIEFshWSzs4+sHAzBVX+789WXRna
+rn8OCdEDPa5i08Uk/xhDfMZ0EfIPEdZHuXoLX/CAFETAG3ZxLHxpW2R+boiueGEz
+NmAnMQYiufMRrxNEX1BZ2UXkS0uG72mx613wbeyDt2sy4Cenn86JJpYKH1k+8dU2
+LCjwtsZIse3UnBn8KvvFixBjkRUv9aeRPgTXwiVYN6GcwOpwE6R3H6qwmHK6AHtX
+iXIIqskxh1DkA4JvtvvDqS25ZIyuqh84Ewt32wA4jwOUv1opXbW5kGK58AWH+Le2
+j1KVmIxBi8opaGGJl7GT2dPxMpVvwiGMk+k6ocwXHzgJXdLQ1aRgJEemFBtIIqvj
+bJSyORDn+vKYOMbWRSzGxa2ySMVekk+BTGUd+1/oNo+0Q5y+kRw=
+=HnJJ
-----END PGP SIGNATURE-----
