Deserialization of Untrusted Data in Apache Camel - CVE-2026-43867
Published: August 24, 2026
Vulnerability identifier: #VU144718
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-43867
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to deserialization of untrusted data in AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() when deserializing persisted key metadata from the configured AWS Secrets Manager secret. A remote user can store a crafted serialized object in the secret to execute arbitrary code.
The unsafe object deserialization occurs before the returned object is checked and cast to KeyMetadata.
Affected software
Apache Camel
How to mitigate CVE-2026-43867
Install security update from vendor's website.
Apache Camel - addressed in versions 4.19.0, 4.21.0