CVE-2026-78162: CWE-502 Deserialization of Untrusted Data in Apache Software Foundation Apache Camel

This vulnerability concerns Apache Camel's camel-hazelcast component where certain Hazelcast instances are created without applying JavaSerializationFilterConfig, a protection introduced in a prior fix (CVE-2026-43865). Specifically, ReplicatedHazelcastAggregationRepository overrides the startup method without applying the filter, and client-mode Hazelcast endpoints create client configurations without the filter. This allows an attacker able to publish serialized Java objects into the connected Hazelcast cluster to trigger deserialization within Hazelcast's serialization layer, leading to remote code execution. Hazelcast clusters do not enable authentication or TLS by default, making exploitation easier if the attacker can access the cluster. The vulnerability affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The issue is fixed in Apache Camel 4.23.0, 4.22.1, and 4.18.5. Older versions are end-of-life and will not be fixed. Mitigations include upgrading, supplying explicit Hazelcast configurations with deserialization filters, injecting Hazelcast instances, JVM serialization filters, and enabling Hazelcast authentication and TLS.

An attacker with the ability to publish data into the Hazelcast cluster connected to a vulnerable Apache Camel instance can cause arbitrary Java objects to be deserialized without restriction. This can lead to remote code execution within the context of the Camel application. The default lack of authentication and TLS in Hazelcast clusters increases the risk of unauthorized access and exploitation. The vulnerability is rated with a CVSS 4.0 score of 10.0 (critical), indicating a severe impact with network attack vector, no required privileges or user interaction, and high confidentiality, integrity, and availability impact.

A fix is available in Apache Camel versions 4.23.0, 4.22.1, and 4.18.5. Users should upgrade to one of these versions to remediate the vulnerability. For users unable to upgrade immediately, mitigations include supplying an explicit Hazelcast configuration that includes a JavaSerializationFilterConfig or injecting a pre-built HazelcastInstance, as user-supplied configurations are respected by Camel. Additionally, setting the JVM-wide serialization filter with the argument -Djdk.serialFilter=!java.net.;java.;javax.;org.apache.camel.;!* can help restrict deserialization. Enabling Hazelcast cluster authentication and TLS is also recommended to restrict access to the cluster and reduce exploitation risk.