SB2026082591 - Multiple vulnerabilities in Apache Camel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082591

SB2026082591 - Multiple vulnerabilities in Apache Camel

Published: August 25, 2026

Security Bulletin ID SB2026082591
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-47323)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code or write arbitrary files.

The vulnerability exists due to improper input validation in the CXF and Knative HeaderFilterStrategy implementations when handling HTTP requests to CXF-RS or CXF-SOAP endpoints. A remote attacker can inject Camel-internal headers to execute arbitrary code or write arbitrary files.

Exploitation requires a route that forwards messages from affected endpoints to header-driven components such as camel-exec or camel-file.


2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-27172)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to unsafe deserialization in the ConsulRegistry deserialize method in camel-consul when processing Java-serialized values read from the Consul KV store. A remote user can write a malicious serialized Java object to the Consul KV store to execute arbitrary code.

Exploitation occurs when Camel performs a lookup against the affected registry.


3) Input validation error (CVE-ID: CVE-2026-33454)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in MailHeaderFilterStrategy when consuming mail messages through camel-mail. A remote attacker can send an email with crafted Camel-prefixed MIME headers to alter downstream route behavior and execute arbitrary code.

Exploitation requires the application to consume email from a monitored mailbox and use downstream components that act on injected Camel headers, such as camel-bean, camel-exec, or camel-sql.


4) Improper Authentication (CVE-ID: CVE-2026-40022)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and disclose sensitive information.

The vulnerability exists due to improper access control in the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer authentication path handling for camel-platform-http-main when handling requests to subpaths under a configured non-root context path. A remote attacker can send crafted unauthenticated requests to protected subpaths to bypass authentication and disclose sensitive information.

The issue occurs when authentication is enabled and a non-root context path is configured for the embedded HTTP server or embedded management server, while the authentication path is not explicitly set. The /observe/info endpoint can expose runtime metadata including user, working directory, home directory, process ID, JVM, and operating system information.


5) Input validation error (CVE-ID: CVE-2026-40453)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code or write arbitrary files.

The vulnerability exists due to improper input validation in non-HTTP HeaderFilterStrategy implementations when processing broker messages with case-variant Camel internal headers. A remote user can inject crafted headers to execute arbitrary code or write arbitrary files.

Exploitation requires producer access to a JMS or equivalent broker consumed by a Camel route, and affects routes that forward messages to header-driven components such as camel-exec or camel-file.


6) Deserialization of Untrusted Data (CVE-ID: CVE-2026-40473)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to unsafe deserialization in MinaConverter.toObjectInput() when processing crafted serialized Java objects received over a TCP or UDP MINA consumer port. A remote attacker can send a crafted serialized Java object to execute arbitrary code.

Exploitation requires a Camel route to use camel-mina as a TCP or UDP consumer and request conversion to ObjectInput, such as via getBody(ObjectInput.class) or @Body ObjectInput.


Remediation

Install update from vendor's website.

References