Information Exposure Through an Error Message in Apache Camel - CVE-2026-85246
Published: October 23, 2026
Vulnerability identifier: #VU157299
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85246
CWE-ID: CWE-209
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information about the deployment, potentially including internal class and package names, paths, host names and connection details.
The vulnerability exists due to generation of error messages containing sensitive information in the Apache Camel Mina consumer when processing an exchange fails. A remote attacker can provoke an exchange-processing failure to receive exception details returned directly over the socket. The textline codec exposes the exception's class name and message, while the object codec exposes the serialized exception, including its cause chain.
Affected software
Apache Camel
How to mitigate CVE-2026-85246
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1