Input validation error in Apache Camel - CVE-2026-85312
Published: October 23, 2026
Vulnerability identifier: #VU157311
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85312
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to hijack saga participation by attaching requests or associating compensation with a long-running action initiated by someone else.
The vulnerability exists due to improper input validation in the Apache Camel Core saga processor when determining saga membership from inbound message headers. A remote attacker can supply a Long-Running-Action header, whose unprefixed name bypasses consumer header filters, to select another party's saga for an exchange or associate compensation with an action they did not initiate.
Exposure is limited to deployments running sagas over an LRA coordinator with a saga service that uses the header.
Affected software
Apache Camel
How to mitigate CVE-2026-85312
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1