CVE-2026-103413

{
  "etk_id": "ETK-2026-1093",
  "cve_id": "CVE-2026-103413",
  "display_id": "CVE-2026-103413",
  "ghsa_id": "GHSA-5c9w-j8c6-h6m2",
  "euvd_id": "EUVD-2026-95757",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unrestricted Kubernetes manifest application in Camel Karavan",
  "summary": "Apache Camel Karavan versions 4.0.0 through before 4.22.1 do not sufficiently constrain Kubernetes resources and sensitive workload settings in deployment manifests. Any authenticated user can cause Karavan to create resources with the permissions assigned to its service account.",
  "mitigation": "Upgrade Apache Camel Karavan to version 4.22.1. Until the upgrade is complete, restrict access to Karavan and limit the permissions of its Kubernetes service account.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Camel Karavan",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, < 4.22.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.22.1"
      ],
      "package_name": "Apache Camel Karavan",
      "purl": null
    }
  ],
  "cwes": [
    20
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0039,
  "epss_percentile": 0.3163,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 57.553115266666666,
  "t0_at": "2026-10-09T12:53:56.120000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-10T20:45:28.289792+00:00",
      "days": 1.327455668888889,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T12:53:56.120000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-09T12:53:56.120000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T12:53:56.120000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103413"
    }
  }
}