Information Exposure Through an Error Message in Apache Camel - CVE-2026-85315
Published: October 23, 2026
Vulnerability identifier: #VU157314
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85315
CWE-ID: CWE-209
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information contained in internal error messages.
The vulnerability exists due to generation of error messages containing sensitive information in the Apache Camel gRPC consumer component when a route fails during request processing. A remote attacker can provoke a route failure to read the exception message copied into the gRPC status description returned to the client, potentially exposing class and package names, paths, host names, and connection details.
Affected software
Apache Camel
How to mitigate CVE-2026-85315
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1