The vulnerability in Apache Camel's camel-infinispan component arises from unsafe deserialization of data read from a remote Infinispan cache. Specifically, the ProtoStream-based remote aggregation repository uses java.io.ObjectInputStream without any ObjectInputFilter, allowing an attacker who can write to the cache to inject malicious serialized Java objects. When these objects are deserialized during aggregation repository operations such as get or recover, they can lead to arbitrary code execution within the application's context. This affects multiple Apache Camel versions prior to the patched releases 4.14.7, 4.18.2, and 4.20.0. The issue is tracked under JIRA ticket CAMEL-23322 and is part of a class of deserialization vulnerabilities previously addressed in CVE-2024-22369, CVE-2024-23114, and CVE-2026-25747.

Successful exploitation allows an attacker with write access to the Infinispan cache to execute arbitrary code within the context of the affected Apache Camel application. This can lead to full compromise of the application, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 8.8 (high severity).

A fix is available. Users should upgrade to Apache Camel version 4.20.0 if using the 4.19.x stream, 4.18.2 if using the 4.18.x stream, or 4.14.7 if using the 4.14.x LTS stream. These versions include the necessary patches to apply ObjectInputFilter protections during deserialization. Patch status is confirmed by the vendor advisory and referenced JIRA ticket. No alternative mitigations are indicated in the advisory.