The vulnerability in Apache Camel PQC involves insecure deserialization of untrusted data in the FileBasedKeyLifecycleManager class. Specifically, it deserializes <keyId>.key files using java.io.ObjectInputStream without any ObjectInputFilter or class-loading restrictions, allowing malicious serialized objects to execute code before type checks occur. An attacker who can write to the key directory—via path traversal, misconfigured permissions, compromised provisioning, or symlink attacks—can exploit this to achieve arbitrary code execution within the application context. Affected versions are Apache Camel PQC 4.18.0 through before 4.18.2 and 4.19.0 through before 4.20.0. The vulnerability is addressed in versions 4.18.2 and 4.20.0 by switching to a safer key storage format using PKCS#8 and X.509 Base64 JSON encoding.

Successful exploitation allows an attacker with write access to the key directory to execute arbitrary code within the Apache Camel application context, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported to date.

Users should upgrade affected Apache Camel PQC versions to 4.20.0 or later, or to 4.18.2 if using the 4.18.x LTS stream, as these versions replace the vulnerable deserialization mechanism with secure Base64 JSON encoding of keys. Patch status is not explicitly stated but the vendor advisory recommends upgrading to these fixed versions. Until upgraded, restrict write access to the key directory to trusted users only to prevent exploitation.