The vulnerability exists in the ConsulRegistry class of the camel-consul component in Apache Camel. It deserializes Java objects read from the Consul KV store without applying an ObjectInputFilter, which is necessary to prevent unsafe deserialization. An attacker able to write to the Consul KV store can inject malicious serialized Java objects. When Camel performs a lookup against the registry, these objects are deserialized, potentially leading to arbitrary code execution in the Camel process. This issue is similar to previously addressed vulnerabilities (CVE-2024-22369, CVE-2024-23114, CVE-2026-25747) but was overlooked during their remediation. The vulnerability affects Apache Camel versions from 3.0.0 up to but not including 4.14.6, and from 4.15.0 up to but not including 4.18.1. Users are advised to upgrade to 4.14.6, 4.18.1, or 4.19.0 where the issue is fixed.

Successful exploitation allows an attacker with write access to the Consul KV store to execute arbitrary code within the Apache Camel process. This can compromise the integrity and availability of the affected system. The CVSS v3.1 score is 8.8 (High), reflecting network attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available. Users should upgrade to Apache Camel version 4.14.6 if using the 4.14.x LTS stream, to 4.18.1 if using the 4.18.x stream, or to 4.19.0 for newer versions. These versions include the necessary patch to prevent unsafe deserialization in the ConsulRegistry component. No alternative mitigations are specified in the vendor advisory; upgrading is the recommended remediation.