Insufficient Granularity of Access Control in Apache Camel - CVE-2026-85316
Published: October 23, 2026
Vulnerability identifier: #VU157315
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85316
CWE-ID: CWE-1220
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause unintended request forwarding and potentially access or modify resources reachable through the forwarding path.
The vulnerability exists due to insufficient granularity of access control in the Apache Camel Platform HTTP component when determining proxy mode using a path prefix rather than an exact path match. A remote attacker can send requests to an endpoint whose configured path begins with proxy, such as proxyStatus or proxy-config, to have traffic forwarded even though the endpoint was not intended to act as a proxy.
Affected software
Apache Camel
How to mitigate CVE-2026-85316
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1