Deserialization of Untrusted Data in Apache Camel - CVE-2026-88900
Published: October 23, 2026
Vulnerability identifier: #VU157320
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-88900
CWE-ID: CWE-502
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker on the local network to execute arbitrary code in the Camel process.
The vulnerability exists due to deserialization of untrusted data without an effective serialization filter in the Apache Camel JGroups consumer when processing incoming cluster messages. A remote attacker on the local network can send a crafted serialized object through the cluster's reachable multicast group or bind port to execute arbitrary code when a usable deserialization gadget chain is present on the application classpath.
Affected software
Apache Camel
How to mitigate CVE-2026-88900
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1, 4.23.0