Overly permissive cross-domain whitelist in Apache Camel - CVE-2026-85313
Published: October 23, 2026
Vulnerability identifier: #VU157312
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85313
CWE-ID: CWE-942
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read sensitive responses to credentialed cross-origin requests.
The vulnerability exists due to a permissive cross-domain policy with untrusted domains in the Apache Camel Jetty component when enabling CORS installs Jetty's CrossOriginFilter with defaults that accept every origin and allow credentials. A remote attacker can trick a victim into visiting a malicious page that makes credentialed cross-origin requests to the endpoint to read responses using the victim's credentials.
Affected software
Apache Camel
How to mitigate CVE-2026-85313
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1