The vulnerability in Apache Camel PQC involves insecure deserialization in the FileBasedKeyLifecycleManager class, which reads serialized Java objects from <keyId>.key files using java.io.ObjectInputStream without applying ObjectInputFilter or class-loading restrictions. This allows any side effects in the deserialized object's readObject() method to execute before type checks, enabling arbitrary code execution if an attacker can write crafted serialized objects to the key directory. Attack vectors include path traversal, misconfigured filesystem permissions, compromised key provisioning, or symlink attacks. The flaw affects Apache Camel versions 4.18.0 up to but not including 4.18.2 and 4.19.0 up to but not including 4.20.0. The issue is resolved by upgrading to 4.18.2 or 4.20.0, which replace the vulnerable deserialization mechanism with secure PKCS#8 and X.509 Base64 JSON encoding for key storage.

Successful exploitation allows an attacker with write access to the key directory to execute arbitrary code within the context of the Apache Camel application. This can lead to full compromise of the application, including confidentiality, integrity, and availability impacts. The CVSS v3.1 score is 7.8 (High), reflecting local attack vector with low complexity, requiring low privileges but no user interaction, and resulting in high impact on confidentiality, integrity, and availability.

A fix is available. Users should upgrade Apache Camel PQC to version 4.20.0 or, if using the 4.18.x LTS stream, to version 4.18.2. These versions replace the insecure deserialization mechanism with secure Base64 JSON encoding of keys, eliminating the vulnerability. Until upgraded, ensure that the key directory is protected against unauthorized write access to prevent exploitation. Check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-40048 for additional guidance.