Apache Camel vulnerabilities

• apache camel Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions CVE-2026-95664 Public exploit 5.4 MediumOctober 26, 2026
• apache camel Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution CVE-2026-88900 Public exploit 8.8 HighOctober 19, 2026
• apache camel Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache CVE-2026-85317 Public exploit 4.8 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching CVE-2026-85316 Public exploit 4.8 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions CVE-2026-85315 Public exploit 5.3 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584) CVE-2026-85314 Public exploit 6.5 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set CVE-2026-85313 Public exploit 4.3 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header CVE-2026-85312 Public exploit 4.8 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State CVE-2026-85296 Public exploit 6.5 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default CVE-2026-85260 Public exploit 5.5 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions CVE-2026-85257 Public exploit 5.3 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing CVE-2026-85254 Public exploit 6.5 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets CVE-2026-85251 Public exploit 7.5 HighOctober 19, 2026
• apache camel Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option CVE-2026-85250 Public exploit 7.5 HighOctober 19, 2026
• apache camel Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata CVE-2026-85249 Public exploit 6.5 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore CVE-2026-85247 Public exploit 5.9 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions CVE-2026-85246 Public exploit 5.3 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target CVE-2026-85245 Public exploit 5.9 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure CVE-2026-85243 Public exploit 5.9 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse CVE-2026-84181 Public exploit 5.9 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions CVE-2026-84180 Public exploit 5.3 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection CVE-2026-84176 Public exploit 6.5 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address CVE-2026-80344 Public exploit 8.2 HighOctober 19, 2026
• apache camel Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching CVE-2026-80343 Public exploit 8.2 HighOctober 19, 2026
• apache camel Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing ent… CVE-2026-79986 Public exploit 7.4 HighOctober 19, 2026
• apache camel Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry conta… CVE-2026-79983 Public exploit 7.4 HighOctober 19, 2026
• apache camel Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) CVE-2026-78162 Public exploit 10.0 CriticalOctober 19, 2026
• apache camel, apache software foundation camel k +1 more Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace CVE-2026-80354 8.1 HighSeptember 10, 2026
• apache camel, apache software foundation camel k +1 more Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod CVE-2026-80351 9.8 CriticalSeptember 10, 2026
• apache camel, apache software foundation camel k +1 more Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects CVE-2026-80352 9.8 CriticalSeptember 10, 2026
• apache camel Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes CVE-2026-78329 Public exploitFix available 9.8 CriticalAugust 24, 2026
• apache camel Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection CVE-2026-71300 Public exploitFix available 9.8 CriticalAugust 24, 2026
• apache camel Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy CVE-2026-63621 Public exploitFix available 5.3 MediumAugust 24, 2026
• apache camel Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by… CVE-2026-66908 Public exploitFix available 7.5 HighAugust 24, 2026
• apache camel Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result CVE-2026-66907 Public exploitFix available 7.5 HighAugust 24, 2026
• apache camel Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir CVE-2026-66906 Public exploitFix available 9.1 CriticalAugust 24, 2026
• apache camel Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir CVE-2026-60093 Public exploitFix available 5.5 MediumAugust 24, 2026
• apache camel Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled CVE-2026-59230 Public exploitFix available 6.5 MediumAugust 24, 2026
• apache camel Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input CVE-2026-46588 Public exploitFix available 7.3 HighJuly 6, 2026
• apache camel Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input CVE-2026-46587 Public exploitFix available 7.3 HighJuly 6, 2026
• apache camel Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters CVE-2026-49042 Public exploitFix available 7.3 HighJuly 6, 2026
• apache camel Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder CVE-2026-43866 Public exploitFix available 7.3 HighJuly 6, 2026
• apache camel Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter CVE-2026-43867 Public exploitFix available 9.8 CriticalJuly 6, 2026
• apache camel, apache software foundation camel aws2 sns +1 more Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components CVE-2026-56140 Fix available 9.8 CriticalJuly 6, 2026
• apache camel, apache software foundation camel undertow +1 more Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal informati… CVE-2026-56139 Public exploitFix available 5.3 MediumJuly 6, 2026
• apache camel, apache software foundation camel iggy +1 more Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling cont… CVE-2026-55994 Public exploitFix available 7.5 HighJuly 6, 2026
• apache camel, apache software foundation camel atmosphere websocket +1 more Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control header… CVE-2026-55993 Public exploitFix available 7.5 HighJuly 6, 2026
• apache camel, apache software foundation camel keycloak +1 more Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null… CVE-2026-53913 Public exploitFix available 9.8 CriticalJuly 6, 2026
• apache camel Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal… CVE-2026-49365 Public exploitFix available 5.3 MediumJuly 6, 2026
• apache camel, apache software foundation camel salesforce +1 more Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour CVE-2026-49099 Public exploitFix available 5.3 MediumJuly 6, 2026
• Show olderLoading…