Incorrect default permissions in Apache Camel - CVE-2026-85300
Published: October 23, 2026
Vulnerability identifier: #VU157309
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85300
CWE-ID: CWE-276
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose private key material stored on disk.
The vulnerability exists due to incorrect default permissions in the Apache Camel PQC component when writing generated key material to disk using the process default umask instead of owner-only permissions. A local user can read private key files when the resulting permissions allow group or world read access to obtain the private key material.
Affected software
Apache Camel
How to mitigate CVE-2026-85300
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1