An authorization bypass vulnerability in Apache Camel K allows authenticated users to access unauthorized secrets, posing a significant risk to multi-tenant cluster security.

This is an authorization bypass vulnerability (CWE-639) occurring within custom resource resolution. An authenticated user with low privileges can manipulate key references to access secrets belonging to other tenants or the operator itself.

The ability for a tenant to access unauthorized secrets can lead to the compromise of sensitive credentials, API keys, or certificates stored within the operator namespace. Given the CVSS score of 8.1, this represents a high-severity risk that could facilitate lateral movement or further unauthorized access across the infrastructure. Such a breach may result in significant data exposure and loss of confidentiality in multi-tenant environments.

Immediate Action: Upgrade Apache Camel K to version 2.9.3, 2.10.2, or 2.11.0 to apply the necessary authorization checks.

Proactive Monitoring: Monitor Kubernetes audit logs for unusual requests directed at secrets or custom resources within the operator namespace.

Compensating Controls: Implement strict Kubernetes Role-Based Access Control (RBAC) policies to limit the namespace access of individual tenants and prevent cross-namespace secret referencing.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a high risk to organizations utilizing Apache Camel K in multi-tenant deployments. Administrators should prioritize patching to the recommended versions immediately to prevent potential unauthorized access to sensitive secrets. Failure to remediate could allow an attacker with limited access to escalate their reach significantly within the cluster environment.