SB2026082548 - Multiple vulnerabilities in Apache Camel
Published: August 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-59230)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to influence downstream route behavior.
The vulnerability exists due to improper input validation in the MimeMultipart data format unmarshal path when unmarshalling a MIME multipart message with headersInline enabled. A remote attacker can supply a crafted MIME header name to influence downstream route behavior.
Only configurations with headersInline enabled are vulnerable; with the default setting, MIME headers are surfaced as attachments instead of message headers.
2) Path traversal (CVE-ID: CVE-2026-60093)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to create or overwrite files outside the configured download directory.
The vulnerability exists due to path traversal in DataLakeFileOperations.downloadToFile when processing remotely supplied Azure Data Lake path names during downloadToFile operations. A remote user can influence the names present in the consumed Data Lake filesystem to create or overwrite files outside the configured download directory.
The issue occurs because listed path names are taken verbatim from the remote filesystem and are not normalized or checked to ensure the resolved path remains within fileDir.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject internal headers to trigger server-side request forgery, path traversal, or message-dispatch redirection.
The vulnerability exists due to improper input validation and improper neutralization of special elements in output used by a downstream component in the Camel Knative consumer when processing structured-mode CloudEvent requests. A remote attacker can send a specially crafted CloudEvent request with extension fields that are copied into Exchange headers to inject internal headers to trigger server-side request forgery, path traversal, or message-dispatch redirection.
Exploitation requires a route that forwards messages from a Knative consumer to a header-driven component such as camel-http or camel-file. Only structured content mode requests with Content-Type application/cloudevents+json are affected.
4) Path traversal (CVE-ID: CVE-2026-66906)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to create or overwrite files outside the intended download directory.
The vulnerability exists due to path traversal in the downloadBlobToFile operation when processing blob names from a consumed container. A remote attacker can place a blob with a crafted name containing parent-directory segments to create or overwrite files outside the intended download directory.
Exploitation requires the ability to influence blob names present in the consumed Azure Storage container.
5) Path traversal (CVE-ID: CVE-2026-66907)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite arbitrary files on the local filesystem.
The vulnerability exists due to path traversal in the camel-google-storage consumer when downloading Google Cloud Storage objects to the local filesystem using the downloadFileName option. A remote user can place or influence an object with a specially crafted name containing parent-directory segments to overwrite arbitrary files on the local filesystem.
The issue is limited to the consumer path that appends the remote object name to the configured destination, and no filtering is applied unless the filter option has been explicitly set.
6) Improper Authentication (CVE-ID: CVE-2026-66908)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass JWT authentication.
The vulnerability exists due to improper authentication in JWT authentication handling in the camel-platform-http-main component when processing JWT-protected requests with a configured keystore but without issuer or audience validation. A remote attacker can present a valid unexpired token signed by a trusted key to bypass JWT authentication.
Both the application server and the management server are affected. The issue occurs when JWT authentication is enabled with keystore properties and neither issuer nor audience is configured.
7) Input validation error (CVE-ID: CVE-2026-71300)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to interfere with WebSocket message delivery.
The vulnerability exists due to improper input validation in the camel-atmosphere-websocket producer when handling HTTP requests bridged into an atmosphere-websocket route. A remote attacker can supply crafted websocket dispatch headers to influence recipient selection and interfere with WebSocket message delivery.
An ordinary inbound HTTP header is sufficient to reach the list-valued dispatch branch, and a message intended for one connected client may be suppressed or redirected to a different client whose connection key is known.
8) Input validation error (CVE-ID: CVE-2026-78329)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to influence websocket message delivery to an unintended peer.
The vulnerability exists due to improper input validation in the Camel Undertow endpoint header filtering logic when processing inbound and outbound undertow headers on endpoint-configured routes. A remote attacker can send specially crafted headers with the legacy websocket. prefix to influence websocket message delivery to an unintended peer.
Only endpoint-configured routes that rely on the default undertow header filter strategy are affected; Rest DSL consumers were not affected.
Remediation
Install update from vendor's website.
References
- https://lists.apache.org/api/email.lua?id=l36doy2oc324z2r2q4df38ckwr2r1t4z
- https://camel.apache.org/security/CVE-2026-59230.html
- https://lists.apache.org/api/email.lua?id=ox2ohf2wkj8zs39trh4g2hjrlwsl2g0z
- https://camel.apache.org/security/CVE-2026-60093.html
- https://lists.apache.org/api/email.lua?id=osgxrz8m1porx7spqdl78lxndyvwxddm
- https://camel.apache.org/security/CVE-2026-63621.html
- https://lists.apache.org/api/email.lua?id=nphp7ogtphboyppkcp3gomwfhmsmxx6z
- https://camel.apache.org/security/CVE-2026-66906.html
- https://lists.apache.org/api/email.lua?id=kk6n4m6mnw7dv4v738fpkfgdltcqrdr7
- https://camel.apache.org/security/CVE-2026-66907.html
- https://lists.apache.org/api/email.lua?id=r9l90mdrdyr23mbcw8yf7ypqwq6dzl38
- https://issues.apache.org/jira/browse/CAMEL-24281
- https://lists.apache.org/api/email.lua?id=g9nzx2py669s96vfpyw8472mbxq83o0v
- https://camel.apache.org/security/CVE-2026-71300.html
- https://lists.apache.org/api/email.lua?id=jp9zdoszy8h6wnn751mwlblkw8w57nwh
- https://camel.apache.org/security/CVE-2026-78329.html