Exposure of Data Element to Wrong Session in Apache Camel - CVE-2026-85296
Published: October 23, 2026
Vulnerability identifier: #VU157308
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85296
CWE-ID: CWE-488
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to expose signing material across trading-partner exchanges and cause message receipts to be attributed to the wrong partner.
The vulnerability exists due to exposure of data elements to the wrong session in the Apache Camel AS2 component when processing concurrent or successive requests using shared signing state. A remote attacker can send AS2 requests to a deployment serving multiple trading partners to cause a Message Disposition Notification to be signed with another partner's key.
Affected software
Apache Camel
How to mitigate CVE-2026-85296
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1