This vulnerability (CVE-2026-27172) involves unsafe deserialization in Apache Camel's ConsulRegistry component. The component reads serialized Java objects from the Consul KV store and deserializes them without filtering, enabling attackers with write permissions to the KV store to inject malicious objects. Successful exploitation can result in arbitrary code execution within the running Camel process. The affected versions include Apache Camel 3.0.0 up to but not including 4.14.6, and versions from 4.15.0 before 4.x. The CVSS v3.1 score is 8.8, indicating high severity. No vendor advisory or patch links are currently provided, and the remediation level is not specified.

An attacker who can write to the Consul KV store used by Apache Camel can exploit this vulnerability to execute arbitrary code within the Camel process. This could lead to full compromise of the affected application environment. The vulnerability impacts confidentiality, integrity, and availability, as reflected in the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Apache Software Foundation advisory for current remediation guidance. Until an official fix is available, restrict write access to the Consul KV store to trusted users only to prevent injection of malicious serialized data. Monitor vendor channels for updates and apply patches promptly once released.