Deserialization of Untrusted Data in Apache Camel - CVE-2026-40048
Published: August 25, 2026
Vulnerability identifier: #VU145337
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40048
CWE-ID: CWE-502
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to unsafe deserialization in the FileBasedKeyLifecycleManager class when deserializing the contents of <keyId>.key files in the configured key directory. A local user can place a crafted serialized Java object in the key directory to execute arbitrary code.
Exploitation requires the ability to write to the key directory used by the application, and code execution occurs during normal key lifecycle operations before the deserialized object is type-checked.
Affected software
Apache Camel
How to mitigate CVE-2026-40048
Install security update from vendor's website.
Apache Camel - update to 4.20.0