The vulnerability in Apache Camel PQC involves unsafe deserialization of key files by the FileBasedKeyLifecycleManager class using java.io.ObjectInputStream without ObjectInputFilter or class-loading restrictions. The deserialization occurs before type checks, enabling execution of side effects embedded in malicious serialized objects. Attackers with write access to the key directory can place crafted serialized Java objects that lead to arbitrary code execution during normal key lifecycle operations. Affected versions are 4.18.0 up to but not including 4.18.2 and 4.19.0 up to but not including 4.20.0. The fix replaces the insecure deserialization mechanism with standard PKCS#8 and X.509 Base64 JSON encoding for key storage.

Successful exploitation allows an attacker with write access to the key directory to execute arbitrary code within the Apache Camel application context. This can lead to full compromise of the affected application instance. The vulnerability requires the attacker to have the ability to write files to the key directory, which may be possible through path traversal, filesystem permission misconfiguration, compromised key provisioning, or symlink attacks.

Users should upgrade to Apache Camel PQC version 4.20.0 or later, or to 4.18.2 if using the 4.18.x LTS stream, where the vulnerability is fixed by replacing insecure deserialization with safer Base64 JSON encoding of keys. No other mitigations are specified. Patch status is not explicitly stated but the vendor advisory clearly recommends upgrading to these fixed versions.