Information Exposure Through an Error Message in Apache Camel - CVE-2026-84180
Published: October 23, 2026
Vulnerability identifier: #VU157295
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84180
CWE-ID: CWE-209
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information about the deployment through exception details returned in HTTP responses.
The vulnerability exists due to generation of error messages containing sensitive information in the Apache Camel Knative HTTP consumer when processing an exchange fails on the consumer side. A remote attacker can provoke a processing failure and read the resulting exception class name, message and stack trace in the response body to obtain internal deployment details, potentially including configuration or connection strings embedded in exception messages.
Affected software
Apache Camel
How to mitigate CVE-2026-84180
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1