Apache Camel vulnerabilities
85 known vulnerabilities affecting apache/camel.
Total CVEs
85
CISA KEV
0
Public exploits
3
Exploited in wild
3
Severity breakdown
CRITICAL30HIGH34MEDIUM19LOW2
Vulnerabilities
Page 5 of 5
CVE-2026-46453P4MEDIUMCVSS 5.3≥ 4.3.0, < 4.14.8≥ 4.15.0, < 4.18.3+1 more2026-07-06
CVE-2026-46453 [MEDIUM] CWE-20 CVE-2026-46453: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache
Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client.
The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCH_QUERY (an advanced query body), OPERATION (which Elasticsearch operation to run), INDEX_NAME, INDEX_SETTINGS
nvd
CVE-2025-66169P4MEDIUMCVSS 5.3≥ 4.10.0, < 4.10.8≥ 4.14.0, < 4.14.3+1 more2026-01-14
CVE-2025-66169 [MEDIUM] CWE-89 CVE-2025-66169: Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Cam
Cypher Injection vulnerability in Apache Camel camel-neo4j component.
This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0
Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.
nvd
CVE-2026-60093P4MEDIUMCVSS 5.5≥ 4.0.0, < 4.14.9≥ 4.15.0, < 4.18.4+1 more2026-08-24
CVE-2026-60093 [MEDIUM] CWE-23 CVE-2026-60093: Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue
Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component
This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0.
The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to the local filesystem through its downloadToFile operati
nvd
CVE-2026-46584P4LOWCVSS 3.7≥ 4.0.0, < 4.14.8≥ 4.15.0, < 4.18.3+1 more2026-07-06
CVE-2026-46584 [LOW] CWE-20 CVE-2026-46584: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component.
The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present, built a per-message JavaMail sender with those values
nvd
CVE-2023-34442P4LOWCVSS 3.3≥ 3.0.0, < 3.14.9≥ 3.18.0, < 3.18.8+2 more2023-07-10
CVE-2023-34442 [LOW] CWE-200 CVE-2023-34442: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundati
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3.
Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x up
nvd
← Previous5 / 5