Vulnerabilities

TI-2026-76368 CVE-2026-88900 · GHSA-wqmw-6vq7-3mxp

Unsafe deserialization in Apache Camel JGroups enables code execution

MEDIUM 41

Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00689 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 CWE-502

TI-2026-76370 CVE-2026-91858 · GHSA-qrg3-hxwc-36jm

External entity resolution in Apache Camel FOP producer

LOW 29

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00306 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 CWE-611

TI-2026-76369 CVE-2026-88901 · GHSA-x4v6-22c3-2wm5

XML external entities resolved by default in Apache Camel Smooks

MEDIUM 42

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00448 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 CWE-611

TI-2026-76367 CVE-2026-85317 · GHSA-5q96-qxg9-rmrw

Shared OAuth2 token cache in Apache Camel HTTP mixes up tokens

LOW 23

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00518 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-524

TI-2026-76366 CVE-2026-85316 · GHSA-7rmf-gx38-35x6

Prefix path matching enables unintended proxy mode in Apache Camel

LOW 23

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00495 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-1220

TI-2026-76365 CVE-2026-85315 · GHSA-xj93-qh7c-f9w3

Apache Camel gRPC consumer exposes internal error messages to callers

LOW 31

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00486 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-209

TI-2026-76364 CVE-2026-85314 · GHSA-crhc-jwx9-cr8c

Header injection in Apache Camel mail.smtp headers via MimeMultipart

LOW 36

Improper Input Validation vulnerability in Apache Camel Mail component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00549 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-20

TI-2026-76363 CVE-2026-85313 · GHSA-qj3g-jvfm-6934

Apache Camel Jetty enableCORS Grants Credentials to Any Origin

LOW 20

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00411 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-942

TI-2026-76362 CVE-2026-85312 · GHSA-r9fc-fx9c-46m4

Saga hijacking in Apache Camel through an unfiltered header

LOW 23

Improper Input Validation vulnerability in Apache Camel Core component.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00533 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-20

TI-2026-76360 CVE-2026-85300 · GHSA-p6fv-47jx-6w55

Incorrect default permissions in Apache Camel PQC expose private keys

LOW 24

Incorrect Default Permissions vulnerability in Apache Camel PQC component.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00165 Published 2026-10-19 Fixed in 4.18.5, 4.22.1 +1 CWE-276

TI-2026-76361 CVE-2026-85301 · GHSA-73pw-28wr-vh7r

Issuer validation bypass in Apache Camel Keycloak component

LOW 22

Improper Authentication vulnerability in Apache Camel Keycloak component.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.003 Published 2026-10-19 Fixed in 4.18.5, 4.22.1 +1 CWE-287

TI-2026-76359 CVE-2026-85296 · GHSA-ggr9-wchc-h5rx

Cross-partner signing key confusion in Apache Camel AS2 component

LOW 30

Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0068 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-488

TI-2026-76358 CVE-2026-85260 · GHSA-9gc9-j9wv-mmw8

Apache Camel MLLP component logs protected health information

LOW 24

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00267 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-532

TI-2026-76357 CVE-2026-85257 · GHSA-g4w9-7494-9r66

Apache Camel CXF Information Disclosure via Unmuted Consumer Exceptions

LOW 31

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00631 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-209

TI-2026-76356 CVE-2026-85254 · GHSA-9jfp-c25q-rf5q

Apache Camel Platform HTTP reflects suppressed request headers

LOW 36

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00678 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-178

TI-2026-76355 CVE-2026-85251 · GHSA-2j38-4xg3-6926

Credential leak to redirect targets in Apache Camel HTTP component

MEDIUM 40

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00665 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-200

TI-2026-76354 CVE-2026-85250 · GHSA-x9f8-58m2-93q2

XML external entity processing in Apache Camel XPath exposes files

MEDIUM 40

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00703 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-611

TI-2026-76353 CVE-2026-85249 · GHSA-xp25-2fp7-pffp

Header injection in Apache Camel Tika component via document metadata

LOW 36

Improper Input Validation vulnerability in Apache Camel Tika component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00678 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-20

TI-2026-76352 CVE-2026-85248 · GHSA-c82p-3629-24h6

Race condition in Apache Camel PQC component skips signature checks

LOW 27

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00424 Published 2026-10-19 Fixed in 4.18.5, 4.22.1 +1 CWE-362

TI-2026-76351 CVE-2026-85247 · GHSA-5p69-3rq2-6qj8

Improper certificate validation in Apache Camel Knative component

LOW 27

Improper Certificate Validation vulnerability in Apache Camel Knative component.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00498 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-295

TI-2026-76350 CVE-2026-85246 · GHSA-83r5-f6fc-33rj

Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions

LOW 31

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00631 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-209

TI-2026-76349 CVE-2026-85245 · GHSA-ww26-c733-j3r5

Apache Camel Thrift data format leaks data between messages

LOW 27

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00495 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-488

TI-2026-76348 CVE-2026-85243 · GHSA-rgg6-2q97-gxhm

Integrity check skipped in Apache Camel Crypto PGP decryption

LOW 27

Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00367 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-354

TI-2026-76347 CVE-2026-84181 · GHSA-xwpw-3mm7-243x

Apache Camel Shiro component skips credential check on subject reuse

LOW 27

Improper Authentication vulnerability in Apache Camel Shiro component.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00505 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-287

TI-2026-76346 CVE-2026-84180 · GHSA-v58v-w6mp-4gfw

Apache Camel Knative consumer leaks exception details in responses

LOW 31

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00648 Published 2026-10-19 Partial fix · 4.18.5, 4.22.1 +1 CWE-209

Vulnerabilities

Filters