This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-website.git
The following commit(s) were added to refs/heads/main by this push:
new 655adee2 chore: add Karavan security advisories for CVE-2026-103412
and CVE-2026-103413 (#1805)
655adee2 is described below
commit 655adee2c48457e522d0924b054d5548aba793bd
Author: Andrea Cosentino <[email protected]>
AuthorDate: Fri Oct 9 10:09:03 2026 +0200
chore: add Karavan security advisories for CVE-2026-103412 and
CVE-2026-103413 (#1805)
Path traversal in project file names on the Git commit path
(CVE-2026-103412)
and unvalidated Kubernetes resource application from a project's
kubernetes.yaml (CVE-2026-103413). Both fixed in Karavan 4.22.1, which is
the
only release carrying the fix - Karavan has no maintenance branches.
Co-authored-by: Claude Opus 5 <[email protected]>
---
content/security/CVE-2026-103412.md | 19 +++++++++++++++++
content/security/CVE-2026-103412.txt.asc | 33 ++++++++++++++++++++++++++++++
content/security/CVE-2026-103413.md | 21 +++++++++++++++++++
content/security/CVE-2026-103413.txt.asc | 35 ++++++++++++++++++++++++++++++++
4 files changed, 108 insertions(+)
diff --git a/content/security/CVE-2026-103412.md
b/content/security/CVE-2026-103412.md
new file mode 100644
index 00000000..08c7660d
--- /dev/null
+++ b/content/security/CVE-2026-103412.md
@@ -0,0 +1,19 @@
+---
+title: "Apache Camel Karavan Security Advisory - CVE-2026-103412"
+date: 2026-10-07T11:00:00+02:00
+url: /security/CVE-2026-103412.html
+draft: false
+type: security-advisory
+cve: CVE-2026-103412
+severity: HIGH
+summary: "Karavan project file names escape the project directory when a
project is committed to Git"
+description: "Improper limitation of a pathname to a restricted directory
('path traversal') vulnerability in Apache Camel Karavan. A project file name
supplied through the project file API was used verbatim as a path segment when
the project was written to the working copy for a Git commit, so a name
containing `../` sequences caused the file content to be written outside the
project directory, to any location writable by the Karavan process. An
authenticated user of any role could use [...]
+mitigation: "Users are recommended to upgrade to version 4.22.1, which fixes
the issue. Apache Camel Karavan has no maintenance branches, so 4.22.1 is the
only release containing the fix."
+credit: "This issue was discovered and reported by CyberLeo"
+affected: "From 3.18.0 before 4.22.1."
+fixed: 4.22.1
+---
+
+Project file names and project ids received through the project file API are
now validated before they are used as path segments: names that are empty,
contain `..`, a path separator or a NUL byte, or that fall outside
`^[a-zA-Z0-9_\-.]+$` are rejected on create, update, rename and copy. The path
built for each file is additionally resolved against the project directory and
refused if the result escapes it, so the write itself is guarded independently
of the entry point.
+
+The commit
https://github.com/apache/camel-karavan/commit/5e4252494817af0cd2697216bd02f361037fedcf
resolved the issue and has more details.
diff --git a/content/security/CVE-2026-103412.txt.asc
b/content/security/CVE-2026-103412.txt.asc
new file mode 100644
index 00000000..e49a8b26
--- /dev/null
+++ b/content/security/CVE-2026-103412.txt.asc
@@ -0,0 +1,33 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Karavan Security Advisory - CVE-2026-103412"
+date: 2026-10-07T11:00:00+02:00
+url: /security/CVE-2026-103412.html
+draft: false
+type: security-advisory
+cve: CVE-2026-103412
+severity: HIGH
+summary: "Karavan project file names escape the project directory when a
project is committed to Git"
+description: "Improper limitation of a pathname to a restricted directory
('path traversal') vulnerability in Apache Camel Karavan. A project file name
supplied through the project file API was used verbatim as a path segment when
the project was written to the working copy for a Git commit, so a name
containing `../` sequences caused the file content to be written outside the
project directory, to any location writable by the Karavan process. An
authenticated user of any role could use [...]
+mitigation: "Users are recommended to upgrade to version 4.22.1, which fixes
the issue. Apache Camel Karavan has no maintenance branches, so 4.22.1 is the
only release containing the fix."
+credit: "This issue was discovered and reported by CyberLeo"
+affected: "From 3.18.0 before 4.22.1."
+fixed: 4.22.1
+- ---
+
+Project file names and project ids received through the project file API are
now validated before they are used as path segments: names that are empty,
contain `..`, a path separator or a NUL byte, or that fall outside
`^[a-zA-Z0-9_\-.]+$` are rejected on create, update, rename and copy. The path
built for each file is additionally resolved against the project directory and
refused if the result escapes it, so the write itself is guarded independently
of the entry point.
+
+The commit
https://github.com/apache/camel-karavan/commit/5e4252494817af0cd2697216bd02f361037fedcf
resolved the issue and has more details.
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrGC7wACgkQ406fOAL/
+QQDTwwf5AdAELHf889yP04lm7Z0TvMeGJ9SPIUGhxw1IlCsWuRQi+eDw/8+bmAEV
+tkQCC45g+KvS8MN6EcbBlmpsgx8hZf3xaNTN+JmVqG2RLrEXGV9tpwVPOn5yP9Pb
+To7fSV//xuB9SnL8blNRhup/9miG38xvO4rsKBRS69ACipRVFzTAogKQooM5Ho/T
+eTxhBUiezVKLgeyUttApqM+t1xkMbGKlz9TFl5lDjcYTh6Yd/jxjkp/qjdSPnvpD
+ywY2rXc9i3VG9QVKICz40LOFWBzDIfP4k7rt4miaCVcyvoWHkHE5MBp2HSP0YUML
+VhVf1hTm1n1iXoshF33dbkDyR4X7DQ==
+=3tHY
+-----END PGP SIGNATURE-----
diff --git a/content/security/CVE-2026-103413.md
b/content/security/CVE-2026-103413.md
new file mode 100644
index 00000000..5b0122dc
--- /dev/null
+++ b/content/security/CVE-2026-103413.md
@@ -0,0 +1,21 @@
+---
+title: "Apache Camel Karavan Security Advisory - CVE-2026-103413"
+date: 2026-10-07T11:00:00+02:00
+url: /security/CVE-2026-103413.html
+draft: false
+type: security-advisory
+cve: CVE-2026-103413
+severity: HIGH
+summary: "Karavan applies unvalidated Kubernetes resources from a project's
kubernetes.yaml"
+description: "Improper input validation vulnerability in Apache Camel Karavan.
When a deployment was started, Karavan unmarshalled a project's
`kubernetes.yaml` and applied every resource it contained to the cluster
without restricting the resource kinds, without rejecting security-sensitive
pod options, and without pinning the target namespace. An authenticated user of
any role could therefore have Karavan apply arbitrary Kubernetes resources
within the reach of its service account, inc [...]
+mitigation: "Users are recommended to upgrade to version 4.22.1, which fixes
the issue. Apache Camel Karavan has no maintenance branches, so 4.22.1 is the
only release containing the fix. Operators should also ensure PodSecurity
admission is enforced on the namespace Karavan deploys into, and keep the
service account's RBAC no wider than Karavan requires."
+credit: "This issue was discovered and reported by MopMonk-AI"
+affected: "From 4.0.0 before 4.22.1."
+fixed: 4.22.1
+---
+
+Resources read from a project's `kubernetes.yaml` are now validated before
they are applied. Each item's kind must appear in
`karavan.deployment.allowed-kinds`
(`Deployment,Service,ConfigMap,Secret,Ingress` as shipped), pod specifications
requesting `hostNetwork`, `hostPID`, `hostIPC`, `hostPath` volumes, host ports,
privileged containers, `allowPrivilegeEscalation` or added capabilities are
rejected, and the namespace of every applied resource is pinned to Karavan's
own regardless of wh [...]
+
+This validation is a restriction on what a project file may ask the cluster
for; it is not a sandbox around user-authored deployment artifacts, and the
Karavan security model continues to treat an authenticated Karavan user as a
trusted deployment operator.
+
+The commit
https://github.com/apache/camel-karavan/commit/a773db372eab9f180110ad6129d58004a1bce571
resolved the issue and has more details.
diff --git a/content/security/CVE-2026-103413.txt.asc
b/content/security/CVE-2026-103413.txt.asc
new file mode 100644
index 00000000..c8b63809
--- /dev/null
+++ b/content/security/CVE-2026-103413.txt.asc
@@ -0,0 +1,35 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+- ---
+title: "Apache Camel Karavan Security Advisory - CVE-2026-103413"
+date: 2026-10-07T11:00:00+02:00
+url: /security/CVE-2026-103413.html
+draft: false
+type: security-advisory
+cve: CVE-2026-103413
+severity: HIGH
+summary: "Karavan applies unvalidated Kubernetes resources from a project's
kubernetes.yaml"
+description: "Improper input validation vulnerability in Apache Camel Karavan.
When a deployment was started, Karavan unmarshalled a project's
`kubernetes.yaml` and applied every resource it contained to the cluster
without restricting the resource kinds, without rejecting security-sensitive
pod options, and without pinning the target namespace. An authenticated user of
any role could therefore have Karavan apply arbitrary Kubernetes resources
within the reach of its service account, inc [...]
+mitigation: "Users are recommended to upgrade to version 4.22.1, which fixes
the issue. Apache Camel Karavan has no maintenance branches, so 4.22.1 is the
only release containing the fix. Operators should also ensure PodSecurity
admission is enforced on the namespace Karavan deploys into, and keep the
service account's RBAC no wider than Karavan requires."
+credit: "This issue was discovered and reported by MopMonk-AI"
+affected: "From 4.0.0 before 4.22.1."
+fixed: 4.22.1
+- ---
+
+Resources read from a project's `kubernetes.yaml` are now validated before
they are applied. Each item's kind must appear in
`karavan.deployment.allowed-kinds`
(`Deployment,Service,ConfigMap,Secret,Ingress` as shipped), pod specifications
requesting `hostNetwork`, `hostPID`, `hostIPC`, `hostPath` volumes, host ports,
privileged containers, `allowPrivilegeEscalation` or added capabilities are
rejected, and the namespace of every applied resource is pinned to Karavan's
own regardless of wh [...]
+
+This validation is a restriction on what a project file may ask the cluster
for; it is not a sandbox around user-authored deployment artifacts, and the
Karavan security model continues to treat an authenticated Karavan user as a
trusted deployment operator.
+
+The commit
https://github.com/apache/camel-karavan/commit/a773db372eab9f180110ad6129d58004a1bce571
resolved the issue and has more details.
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrGC8IACgkQ406fOAL/
+QQDWUAgAgsLUfslSVd2uSdWK2HKrQXF8TXqXqECTI/Fi6UxzVXHsbiyGZYFmGGnD
+F9RPXNbzfXWccfKxKQQmhgSNSO0OWYxDrwdU4O94yUI2Rf5D5xNMbTDQf2p+CS0f
+GDwR9G5g6LvcetXHOT7M8/LC8TK1z3/h+bU9CFdHs1ulsSQdIB+ij9Gme8mlr04Q
+CP4+kmJrZ+tXbTdJ8+KF3dg3oNH8Jwdw1Tcnn2nqEz3pdjlpN3wO912c3+ObRoKF
+b6DoWouNlUVZKDrfn/4n/h+UJLPV8VKNGTunqhhk47g1906VY0fETWvQ2HztHIzD
+Tnm7VjA3eBk4ULqDsTFPzMhz3jrDQw==
+=5HZP
+-----END PGP SIGNATURE-----
