Information Exposure Through an Error Message in Apache Camel - CVE-2026-85257
Published: October 23, 2026
Vulnerability identifier: #VU157306
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85257
CWE-ID: CWE-209
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose internal deployment information, including class names, package names, and sensitive exception message contents.
The vulnerability exists due to generation of error messages containing sensitive information in the Apache Camel CXF SOAP consumer when a route fails with an exception not declared by the service contract. A remote attacker can provoke a route failure to obtain internal exception details copied into the SOAP faultstring.
Stack traces can also be included in the SOAP fault detail if the CXF configuration enables this behavior.
Affected software
Apache Camel
How to mitigate CVE-2026-85257
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1