Improper Certificate Validation in Apache Camel - CVE-2026-85247
Published: October 23, 2026
Vulnerability identifier: #VU157300
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85247
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information transmitted over TLS connections.
The vulnerability exists due to improper certificate validation in the Apache Camel Knative HTTP client when SSL is enabled without a configured truststore. A remote attacker can intercept connections from a position on the network path and present an arbitrary certificate, which the client accepts instead of validating against the JVM's default trust anchors, to read sensitive transmitted information.
Affected software
Apache Camel
How to mitigate CVE-2026-85247
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1