SB2026102309 - Multiple vulnerabilities in Apache Camel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102309

SB2026102309 - Multiple vulnerabilities in Apache Camel

Published: October 23, 2026

Security Bulletin ID SB2026102309
CSH Severity
High
Patch available
YES
Number of vulnerabilities 39
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 18% Medium 74% Low 8%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 39 vulnerabilities.


1) Improper Authentication (CVE-ID: CVE-2026-85301)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass issuer validation and authenticate using a token not issued by the configured issuer.

The vulnerability exists due to improper authentication in the Apache Camel Keycloak component's security processor when processing token introspection responses that omit the iss claim. A remote attacker can present a token minted by a different issuer to bypass the skipped issuer check and authenticate as a caller the deployment should reject.

Exploitation requires an introspection endpoint that accepts tokens from multiple issuers, which is not the default Keycloak arrangement.


2) Race condition (CVE-ID: CVE-2026-85248)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass signature verification and cause messages whose signatures were not actually checked to be accepted as successfully verified.

The vulnerability exists due to a race condition in the Apache Camel PQC producer when processing concurrent exchanges through the same endpoint using a shared, unsynchronized java.security.Signature instance. A remote attacker can send concurrent messages to cause update() and verify() calls from different exchanges to interleave, potentially causing verification to report success for a message whose signature was never actually checked.


3) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-85249)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to manipulate downstream processing and file write destinations through injected Exchange headers, potentially disclosing or modifying data.

The vulnerability exists due to insufficient filtering of document metadata keys in the Apache Camel Tika producer when mapping parsed metadata onto Exchange headers. A remote attacker can submit a crafted document containing metadata keys such as CamelFileName to inject headers that influence downstream components and control where content is written.


4) XML External Entity injection (CVE-ID: CVE-2026-85250)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose files readable by the Camel process and cause it to issue requests to attacker-specified hosts.

The vulnerability exists due to improper restriction of XML external entity references in the Apache Camel XPath component's XPathBuilder when processing untrusted XML with documentType=InputSource. A remote attacker can submit XML containing a DOCTYPE declaration with an external entity that is resolved and expanded by a JDK-default parser, bypassing the default document type's parser hardening, to disclose files readable by the Camel process or cause requests to attacker-specified hosts.


5) Information disclosure (CVE-ID: CVE-2026-85251)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain OAuth2 bearer tokens or configured basic and digest authentication credentials.

The vulnerability exists due to improper credential scoping in the Apache Camel HTTP component when following redirects to another host. A remote attacker can control or influence an endpoint's responses and return a redirect to a host under their control to collect credentials, because the OAuth2 request interceptor reattaches bearer tokens on redirect hops and basic and digest credentials use an AuthScope matching any host.

Exploitation requires followRedirects=true on an endpoint carrying credentials.


6) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-85254)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass request-header echo suppression and reflect attacker-controlled content into HTTP responses, potentially enabling response-splitting and cache-poisoning attacks against infrastructure in front of the Camel endpoint.

The vulnerability exists due to improper handling of case sensitivity in the Apache Camel Platform HTTP component when comparing request header names to prevent their reflection into responses. A remote attacker can vary the casing of a request header name to bypass the case-sensitive comparison and cause caller-chosen content to be echoed in the response.


7) Information Exposure Through an Error Message (CVE-ID: CVE-2026-85257)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose internal deployment information, including class names, package names, and sensitive exception message contents.

The vulnerability exists due to generation of error messages containing sensitive information in the Apache Camel CXF SOAP consumer when a route fails with an exception not declared by the service contract. A remote attacker can provoke a route failure to obtain internal exception details copied into the SOAP faultstring.

Stack traces can also be included in the SOAP fault detail if the CXF configuration enables this behavior.


8) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-85260)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to obtain protected health information from application logs.

The vulnerability exists due to insertion of sensitive information into log files in the Apache Camel MLLP component when processing HL7 clinical messages. Payload logging is enabled by default through the logPhi option, and two logging paths ignore that option. A local user can read application logs accessible to them to obtain patient data contained in logged message payloads.


9) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-85296)

CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to expose signing material across trading-partner exchanges and cause message receipts to be attributed to the wrong partner.

The vulnerability exists due to exposure of data elements to the wrong session in the Apache Camel AS2 component when processing concurrent or successive requests using shared signing state. A remote attacker can send AS2 requests to a deployment serving multiple trading partners to cause a Message Disposition Notification to be signed with another partner's key.


10) Incorrect default permissions (CVE-ID: CVE-2026-85300)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose private key material stored on disk.

The vulnerability exists due to incorrect default permissions in the Apache Camel PQC component when writing generated key material to disk using the process default umask instead of owner-only permissions. A local user can read private key files when the resulting permissions allow group or world read access to obtain the private key material.


11) Improper Certificate Validation (CVE-ID: CVE-2026-85247)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information transmitted over TLS connections.

The vulnerability exists due to improper certificate validation in the Apache Camel Knative HTTP client when SSL is enabled without a configured truststore. A remote attacker can intercept connections from a position on the network path and present an arbitrary certificate, which the client accepts instead of validating against the JVM's default trust anchors, to read sensitive transmitted information.


12) Input validation error (CVE-ID: CVE-2026-85312)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to hijack saga participation by attaching requests or associating compensation with a long-running action initiated by someone else.

The vulnerability exists due to improper input validation in the Apache Camel Core saga processor when determining saga membership from inbound message headers. A remote attacker can supply a Long-Running-Action header, whose unprefixed name bypasses consumer header filters, to select another party's saga for an exchange or associate compensation with an action they did not initiate.

Exposure is limited to deployments running sagas over an LRA coordinator with a saga service that uses the header.


13) Overly permissive cross-domain whitelist (CVE-ID: CVE-2026-85313)

CWE-ID: CWE-942 - Overly Permissive Cross-domain Whitelist

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read sensitive responses to credentialed cross-origin requests.

The vulnerability exists due to a permissive cross-domain policy with untrusted domains in the Apache Camel Jetty component when enabling CORS installs Jetty's CrossOriginFilter with defaults that accept every origin and allow credentials. A remote attacker can trick a victim into visiting a malicious page that makes credentialed cross-origin requests to the endpoint to read responses using the victim's credentials.


14) Input validation error (CVE-ID: CVE-2026-85314)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to manipulate downstream mail connections and message delivery, potentially disclosing sensitive message information.

The vulnerability exists due to improper input validation in the Apache Camel Mail component's MimeMultipart data format when unmarshalling multipart messages maps mail.smtp headers onto the Exchange without applying a header filter. A remote attacker can send a multipart message containing crafted mail.smtp headers to influence how a downstream mail producer connects and sends messages, potentially altering delivery behavior and exposing message information.


15) Information Exposure Through an Error Message (CVE-ID: CVE-2026-85315)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information contained in internal error messages.

The vulnerability exists due to generation of error messages containing sensitive information in the Apache Camel gRPC consumer component when a route fails during request processing. A remote attacker can provoke a route failure to read the exception message copied into the gRPC status description returned to the client, potentially exposing class and package names, paths, host names, and connection details.


16) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-85316)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause unintended request forwarding and potentially access or modify resources reachable through the forwarding path.

The vulnerability exists due to insufficient granularity of access control in the Apache Camel Platform HTTP component when determining proxy mode using a path prefix rather than an exact path match. A remote attacker can send requests to an endpoint whose configured path begins with proxy, such as proxyStatus or proxy-config, to have traffic forwarded even though the endpoint was not intended to act as a proxy.


17) Use of cache containing sensitive information (CVE-ID: CVE-2026-85317)

CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause requests to carry broader authority than configured or disclose OAuth2 tokens to unintended recipients.

The vulnerability exists due to incomplete cache key construction in the Apache Camel HTTP component's JVM-global OAuth2 client token cache when processing requests for endpoints with different OAuth2 settings. A remote attacker can trigger reuse of a cached token associated with a different scope, resource indicator, or token endpoint to cause requests to carry unintended authority or expose tokens to recipients they were not issued for.

Exploitation requires multiple OAuth2 endpoints in the same JVM whose token configurations differ only in the requested scope, resource indicator, or token endpoint.


18) XML External Entity injection (CVE-ID: CVE-2026-88901)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read local files accessible to the Camel process, issue requests to internal network locations, and potentially degrade service availability.

The vulnerability exists due to improper restriction of XML external entity references in the Apache Camel Smooks data format and component when unmarshalling XML message bodies with the default Woodstox SAX reader. A remote attacker can supply an XML body containing an external entity declaration or a DOCTYPE with an external subset to cause the parser to resolve external resources, disclose file contents through the unmarshalled result on InOut routes, or send requests to document-specified hosts.

Configurations that declare an EDI, CSV, JSON, or custom reader do not use the vulnerable XML reader and are not affected.


19) XML External Entity injection (CVE-ID: CVE-2026-91858)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read files accessible to the Camel process and cause it to issue requests to attacker-specified hosts.

The vulnerability exists due to improper restriction of XML external entity resolution in Apache Camel's FopProducer when transforming untrusted XSL-FO message bodies. A remote attacker can submit an XSL-FO document containing a DOCTYPE with an external subset or an external general entity to disclose accessible file contents and trigger requests to hosts specified in the document.

Exploitation requires an alternative JAXP TransformerFactory on the classpath; default deployments using the JDK's built-in transformer are not affected.


20) Deserialization of Untrusted Data (CVE-ID: CVE-2026-88900)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker on the local network to execute arbitrary code in the Camel process.

The vulnerability exists due to deserialization of untrusted data without an effective serialization filter in the Apache Camel JGroups consumer when processing incoming cluster messages. A remote attacker on the local network can send a crafted serialized object through the cluster's reachable multicast group or bind port to execute arbitrary code when a usable deserialization gadget chain is present on the application classpath.


21) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-80344)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to induce server-side requests to arbitrary destinations, including internal network hosts, and disclose credentials configured for asynchronous receipt delivery.

The vulnerability exists due to insufficient validation of the asynchronous Message Disposition Notification (MDN) delivery address in the Apache Camel AS2 component when processing inbound AS2 messages. A remote attacker can supply an attacker-controlled delivery address to cause the AS2 receiver to send an outgoing receipt to an arbitrary host, including hosts reachable only within the deployment's network, and expose MDN delivery credentials if the outbound connection carries them.


22) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-78163)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to trigger server-side requests to attacker-selected URLs and disclose sensitive local file contents.

The vulnerability exists due to unvalidated, prefix-based interpretation of string message bodies in the Apache Camel DoclingProducer component when processing messages forwarded to a docling endpoint. A remote attacker can supply a message body beginning with http:// or https:// to trigger a remote fetch, or a body beginning with / or containing a backslash to select a local filesystem path, to access remote resources or disclose local file contents instead of converting the supplied text.


23) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: CVE-2026-78164)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive configuration values and trigger unauthorized bean operations.

The vulnerability exists due to improper neutralization of special elements used in a template engine in Apache Camel HTTP producer components when resolving property placeholders in message-supplied URI override headers. A remote attacker can supply crafted CamelHttpUri or CamelRestHttpUri values to access environment variables, JVM system properties and registered secret functions, and invoke no-argument methods on registry beans through camel-bean.


24) Deserialization of Untrusted Data (CVE-ID: CVE-2026-78165)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code in the Apache Camel application.

The vulnerability exists due to deserialization of untrusted data without an object input filter in the Apache Camel Spring Redis component when reading Redis payloads using its default Java serializer. A remote user can publish crafted serialized objects to a subscribed Redis channel or place them in Redis data subsequently read by the component to execute arbitrary code during deserialization.


25) Path traversal (CVE-ID: CVE-2026-79983)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read, delete or rename files outside the configured remote polling directory using the endpoint's credentials.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in Apache Camel's camel-ftp remote-file consumers when resolving file names supplied in remote directory listings without path normalization or containment checks. A remote attacker can supply a listing entry containing directory traversal segments through a malicious server, or rewrite an unprotected FTP listing response in transit, to cause file operations outside the configured polling directory.


26) Path traversal (CVE-ID: CVE-2026-79984)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read, delete or rename files outside the configured remote polling directory using the endpoint's credentials.

The vulnerability exists due to path traversal in the Apache Camel Mina SFTP consumer when resolving remote file paths from server-supplied directory listings without normalization or directory containment checks. A remote attacker can supply a crafted listing entry containing parent-directory traversal segments through a malicious or compromised SFTP server to cause file operations outside the configured polling directory.

Retrieval is reachable with the default consumer configuration; deletion requires delete=true, while renaming requires move, preMove, moveFailed or readLock=rename.


27) Path traversal (CVE-ID: CVE-2026-79985)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read files outside the configured polling directory and, when deletion or renaming is configured, delete or rename files outside that directory using the endpoint's credentials.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in the Apache Camel SMB consumer when constructing remote file paths from server-supplied directory listing names. A remote attacker can supply a listing entry containing traversal segments to make subsequent file operations access paths outside the configured polling directory without normalization or a containment check.

Exploitation requires a server to emit a listing name that is not a single path segment, which a conforming SMB2 implementation does not do. No proof of concept against the SMB scheme was demonstrated.


28) Path traversal (CVE-ID: CVE-2026-79986)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read, delete or rename files outside the configured polling directory using the endpoint's credentials.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in the Apache Camel Azure Files consumer when resolving remote paths from server-supplied directory listings without normalization or containment checks. A remote attacker can supply a listing entry containing traversal segments to cause retrieval of files outside the polling directory, or deletion and renaming when the corresponding disposition options are configured.

The Azure Files REST service does not normally return listing names containing multiple path segments, and exploitation against this scheme has not been demonstrated.


29) Improper Authentication (CVE-ID: CVE-2026-80312)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass OAuth authentication and access protected route endpoints, potentially disclosing sensitive information and performing unauthorized actions.

The vulnerability exists due to fail-open authentication handling in the Apache Camel OAuth processors when an authenticated session cannot be established. A remote attacker can send a request that fails authentication to a route configured to require OAuth to reach the protected endpoint because the processors return control to the route instead of stopping the exchange.


30) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-80343)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass security constraints and access protected routes without authorization, potentially exposing sensitive data and permitting restricted operations.

The vulnerability exists due to improper handling of case sensitivity in the Apache Camel Netty HTTP security constraint when comparing request paths against the configured context path. A remote attacker can change the case of a character in a request path segment to evade the case-sensitive security check while routing still dispatches the request to the same protected endpoint, gaining access without satisfying its security constraint.


31) Deserialization of Untrusted Data (CVE-ID: CVE-2026-78162)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data without a Java deserialization filter in Camel-managed Hazelcast instances when processing serialized objects from an attached Hazelcast cluster. A remote attacker can publish a malicious serialized Java object into that cluster to execute arbitrary code within the affected instance before Camel processes the exchange.

The affected configuration paths are ReplicatedHazelcastAggregationRepository without a supplied hazelcastInstance, and client-mode endpoints without either a referenced ClientConfig or hazelcastConfigUri.


32) Improper Neutralization of Special Elements used in an Expression Language Statement (CVE-ID: CVE-2026-83531)

CWE-ID: CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code with the privileges of the Camel process.

The vulnerability exists due to improper neutralization of expression language statements in the Apache Camel dynamic-router-control endpoint when processing subscription or update control messages containing predicate expressions and expression language names. A remote user can send a crafted control message through a transport whose route forwards messages to this endpoint, causing a supplied expression to be compiled without a language allow-list and evaluated against routed exchanges to execute arbitrary code.


33) Overly permissive cross-domain whitelist (CVE-ID: CVE-2026-84176)

CWE-ID: CWE-942 - Overly Permissive Cross-domain Whitelist

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information by reading credentialed cross-origin responses from a Camel endpoint.

The vulnerability exists due to a permissive cross-domain policy with untrusted domains in the Apache Camel Platform HTTP Vertx createCorsHandler() function when handling requests carrying an Origin header. A remote attacker can trick a victim into visiting a malicious page that sends credentialed cross-origin requests to read sensitive responses because the handler reflects arbitrary origins in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true.


34) Cross-site request forgery (CVE-ID: CVE-2026-84178)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to sign a victim into an attacker-controlled account, causing the victim's subsequent actions and submitted data to be associated with that account.

The vulnerability exists due to missing session-bound state validation in the Apache Camel OAuth authorization code callback when processing authorization responses. A remote attacker can trick a victim into submitting a callback containing an authorization code obtained in another browser to associate the attacker-controlled identity with the victim's session.


35) Information Exposure Through an Error Message (CVE-ID: CVE-2026-84180)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information about the deployment through exception details returned in HTTP responses.

The vulnerability exists due to generation of error messages containing sensitive information in the Apache Camel Knative HTTP consumer when processing an exchange fails on the consumer side. A remote attacker can provoke a processing failure and read the resulting exception class name, message and stack trace in the response body to obtain internal deployment details, potentially including configuration or connection strings embedded in exception messages.


36) Improper Authentication (CVE-ID: CVE-2026-84181)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and access sensitive information under another principal's identity.

The vulnerability exists due to improper authentication in the Apache Camel Shiro security processor when an incoming exchange names the same principal as a subject left bound to a reused thread by an earlier authenticated exchange. A remote attacker can send a request naming a principal in active use without valid credentials to bypass credential verification and access sensitive information as that principal if the request is processed on a thread retaining the matching subject.


37) Improper validation of integrity check value (CVE-ID: CVE-2026-85243)

CWE-ID: CWE-354 - Improper Validation of Integrity Check Value

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass message integrity verification and cause modified encrypted content to be accepted without detection.

The vulnerability exists due to improper validation of integrity check values in the Apache Camel Crypto PGP component's unmarshal() method when processing messages that use legacy OpenPGP symmetrically encrypted data packets without a modification detection code. A remote attacker can supply or rewrite a message using this attacker-selected packet type to bypass integrity verification and manipulate decrypted content through the malleability of OpenPGP's CFB mode.


38) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-85245)

CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose another sender's data across message exchanges.

The vulnerability exists due to reuse of a process-wide shared deserialization target in the Apache Camel Thrift data format when unmarshalling incoming messages. A remote attacker can submit a message that omits fields populated by a previous message to expose retained values belonging to another sender during processing of the resulting exchange.


39) Information Exposure Through an Error Message (CVE-ID: CVE-2026-85246)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information about the deployment, potentially including internal class and package names, paths, host names and connection details.

The vulnerability exists due to generation of error messages containing sensitive information in the Apache Camel Mina consumer when processing an exchange fails. A remote attacker can provoke an exchange-processing failure to receive exception details returned directly over the socket. The textline codec exposes the exception's class name and message, while the object codec exposes the serialized exception, including its cause chain.


Remediation

Install update from vendor's website.

References