The vulnerability CVE-2026-40858 in Apache Camel's camel-infinispan component involves unsafe deserialization of data read from a remote Infinispan cache. The ProtoStream-based remote aggregation repository uses java.io.ObjectInputStream without applying ObjectInputFilter, allowing attackers who can write to the cache to inject crafted serialized Java objects. These objects can trigger arbitrary code execution when deserialized during aggregation repository operations such as get or recover. The flaw affects Apache Camel versions 4.0.0 up to but not including 4.14.7, 4.15.0 up to but not including 4.18.2, and 4.19.0 up to but not including 4.20.0. The issue has been addressed in Apache Camel releases 4.14.7, 4.18.2, and 4.20.0. Red Hat advisories confirm the vulnerability and provide updated builds to mitigate the risk.

Successful exploitation allows an attacker with write access to the Infinispan cache used by a Camel application to execute arbitrary code within the application's context. This can lead to full compromise of the affected application, including confidentiality, integrity, and availability impacts. The CVSS v3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrading to Apache Camel versions 4.14.7, 4.18.2, or 4.20.0, depending on the release stream in use, fully addresses this vulnerability. Red Hat users should apply the corresponding security updates provided in their advisories (e.g., Red Hat Build of Apache Camel 4.18 for Quarkus 3.33.1.GA). Before applying updates, back up existing installations and configurations. There is no indication that any temporary or alternative mitigations exist; patching is the recommended and effective remediation.