Read the docs
TI-2026-76360 Aliases CVE-2026-85300GHSA-p6fv-47jx-6w55

Incorrect default permissions in Apache Camel PQC expose private keys

Priority LOW 24CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Apache Camel from 4.12.0 before 4.18.5 and from 4.19.0 before 4.22.1 writes key material generated by its PQC component with permissions set by the process umask instead of owner-only access (CWE-276). On a host whose umask allows group or world read, a local user with low privileges can read the private key. The flaw is not listed in CISA KEV and no public exploit is linked.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than restricting the file to its owner. On a host whose umask allows group or world read, the private key was therefore readable by other local accounts. The exposure is to a local party rather than to the remote sender that the Camel threat model treats as the primary adversary, which is why the severity is assessed low, but the consequence where it applies is complete: possession of the private key defeats every signature and key exchange the deployment performs with it. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Key material is now written with owner-only permissions. For deployments that cannot upgrade immediately, place the key directory on a path only the service account can traverse, and tighten the process umask. Key material already written with permissive permissions should be treated as exposed and rotated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00165 5th percentileScored 2026-11-07
Fix Fixed Apache Camel (Apache Software Foundation): 4.18.5, 4.22.1, 4.23.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Camel4.12.0 to before 4.18.5; 4.19.0 to before 4.22.14.18.5, 4.22.1, 4.23.0Patch availableCNA
  • Apache Camel VendorApache Affected 4.12.0 to before 4.18.5; 4.19.0 to before 4.22.1 Fixed in 4.18.5, 4.22.1, 4.23.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*——Apache
  • cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions — — ·Apache

Remediation

Upgrade Apache Camel to 4.18.5 for the 4.18.x releases, to 4.22.1 for the 4.22.x releases, or to 4.23.0, which fixes the issue. Key material already written with permissive permissions should be treated as exposed and rotated. Until the upgrade, place the key directory on a path only the service account can traverse and tighten the process umask.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Apache Camel (Apache Software Foundation) Fixed in 4.18.5, 4.22.1, 4.23.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Camel 4.18.5, 4.22.1

    39 records Highest priority Priority HIGH 6 HIGH, 9 MEDIUM, 24 LOW

    Other records, highest priority first

    • TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcastPriority HIGH 82
    • TI-2026-76339 Path traversal in Apache Camel azure-files componentPriority HIGH 74
    • TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directoryPriority HIGH 74
    Show all 39 records →

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-85300
  2. 2026-10-19 Alias added: GHSA-p6fv-47jx-6w55
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Priority changed: MEDIUM → LOW

References

Patch 3

Advisory 1

Other 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences