Apache Software Foundation Apache Camel vulnerabilities

CVE-2026-49365 [MEDIUM] CWE-209 CVE-2026-49365: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTT Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false because the backing field was an uninitialised pri

CVE-2026-46453 [MEDIUM] CWE-20 CVE-2026-46453: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCH_QUERY (an advanced query body), OPERATION (which Elasticsearch operation to run), INDEX_NAME, INDEX_SETTINGS

CVE-2025-66169 [MEDIUM] CWE-89 CVE-2025-66169: Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Cam Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.

CVE-2026-84180 [MEDIUM] CWE-209 CVE-2026-84180: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative c Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed on the consumer side, the Knative HTTP consumer wrote the resulting exception back to the remote caller as the resp

CVE-2026-84178 [MEDIUM] CWE-352 CVE-2026-84178: Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affec Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and the callback did not verify one. An authorization co

CVE-2026-85300 [MEDIUM] CWE-276 CVE-2026-85300: Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apach Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than restricting the file to its owner. On a host whose um

CVE-2026-85257 [MEDIUM] CWE-209 CVE-2026-85257: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF compo Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, the exception was described back to the SOAP client i

CVE-2026-85246 [MEDIUM] CWE-209 CVE-2026-85246: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina comp Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed, the Mina consumer wrote exchange.getException() straight back over the socket to the remote peer. Over a textline cod

CVE-2026-85315 [MEDIUM] CWE-209 CVE-2026-85315: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC comp Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status description. Unlike the status cause, which stays local

CVE-2026-60093 [MEDIUM] CWE-23 CVE-2026-60093: Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to the local filesystem through its downloadToFile operati

CVE-2026-85260 [MEDIUM] CWE-532 CVE-2026-85260: Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log. It defaulted to true, so a deployment that did nothi

CVE-2026-85301 [MEDIUM] CWE-287 CVE-2026-85301: Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim. When the claim was absent the check was skipped rat

CVE-2026-85317 [MEDIUM] CWE-524 CVE-2026-85317: Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This is Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a token actually authorises: the requested scope, the reso

CVE-2026-85312 [MEDIUM] CWE-20 CVE-2026-85312: Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache C Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer he

CVE-2026-85316 [MEDIUM] CWE-1220 CVE-2026-85316: Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. T Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with the string proxy, rather than by matching the path ex

CVE-2026-85313 [MEDIUM] CWE-942 CVE-2026-85313: Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator a

CVE-2026-46584 [LOW] CWE-20 CVE-2026-46584: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present, built a per-message JavaMail sender with those values

CVE-2026-90885 [HIGH] CWE-611 CVE-2026-90885: Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse optio

CVE-2026-95664 [MEDIUM] CWE-917 CVE-2026-95664: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression La Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from th

CVE-2026-101259 [MEDIUM] CWE-209 CVE-2026-101259: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP comp Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caught the resulting exception and sent its message