Inclusion of Sensitive Information in Log Files in Apache Camel - CVE-2026-85260
Published: October 23, 2026
Vulnerability identifier: #VU157307
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85260
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to obtain protected health information from application logs.
The vulnerability exists due to insertion of sensitive information into log files in the Apache Camel MLLP component when processing HL7 clinical messages. Payload logging is enabled by default through the logPhi option, and two logging paths ignore that option. A local user can read application logs accessible to them to obtain patient data contained in logged message payloads.
Affected software
Apache Camel
How to mitigate CVE-2026-85260
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1