Read the docs
TI-2026-76344 Aliases CVE-2026-84176GHSA-vxj7-chgp-72vh

Cross-origin credential exposure in Apache Camel Platform HTTP Vertx

Priority LOW 30CWE-942Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Apache Camel from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 has a permissive cross-domain policy in its Platform HTTP Vertx component (CWE-942). The CORS handler sends Access-Control-Allow-Credentials: true on every response to a request with an Origin header, and with no origin list configured it reflects any origin. A remote attacker who lures a user to a web page can make credentialed cross-origin requests to the Camel endpoint and read the responses.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another. For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00577 47th percentileScored 2026-11-07
Fix Partial Apache Camel (Apache Software Foundation): 4.18.5, 4.22.1, 4.23.0Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Camel4.0.0 to before 4.18.5; 4.19.0 to before 4.22.14.18.5, 4.22.1, 4.23.0Patch availableCNA
  • Apache Camel VendorApache Affected 4.0.0 to before 4.18.5; 4.19.0 to before 4.22.1 Fixed in 4.18.5, 4.22.1, 4.23.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*4.0.0 to before 4.18.5; 4.19.0 to before 4.22.1VulnerableApache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.18.5; 4.19.0 to before 4.22.1 Vulnerable ·Apache

Remediation

Upgrade Apache Camel to 4.18.5 on the 4.18.x stream, 4.22.1 on the 4.22.x stream, or 4.23.0. The sources list no fixed version for OpenShift Serverless, Red Hat build of Apache Camel 4 for Quarkus 3 and Red Hat build of Apache Camel for Spring Boot 4, and no planned fix for Red Hat Fuse 7. Until upgrading, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Apache Camel (Apache Software Foundation) Fixed in 4.18.5, 4.22.1, 4.23.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Camel 4.18.5, 4.22.1

    39 records Highest priority Priority HIGH 6 HIGH, 9 MEDIUM, 24 LOW

    Other records, highest priority first

    • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcastPriority HIGH 82
    • TI-2026-76339 Path traversal in Apache Camel azure-files componentPriority HIGH 74
    • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directoryPriority HIGH 74
    Show all 39 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-84176
  2. 2026-10-19 Alias added: GHSA-vxj7-chgp-72vh
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: MEDIUM → LOW
  5. 2026-11-04 Affected versions changed · Red Hat
  6. 2026-11-04 CVSS score added · Red Hat

References

Patch 5

  • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
  • TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
  • TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
  • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
  • TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
  • TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
See all 116 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences