CVE-2026-84176: CWE-942 Permissive Cross-domain Policy with Untrusted Domains in Apache Software Foundation Apache Camel

The vulnerability in Apache Camel Platform HTTP Vertx component (CVE-2026-84176) is due to the createCorsHandler() method setting the Access-Control-Allow-Credentials header to true on all responses with an Origin header, regardless of whether the origin is allowed. If camel.server.cors.origins is unset, the handler treats all origins as allowed and reflects the caller's Origin header, effectively allowing credentialed cross-origin requests from any origin. This creates a permissive cross-domain policy with untrusted domains, violating the fetch specification's rules against credentialed wildcard origins. The issue affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The fix, introduced in versions 4.18.5, 4.22.1, and 4.23.0, restricts Access-Control-Allow-Credentials to responses where the origin matches a configured allowed origin. Additionally, the Vary: Origin header is set when reflecting origins to prevent shared cache issues. Users unable to upgrade immediately should explicitly configure allowed origins via camel.server.cors.origins.

This vulnerability allows any web page from any origin to make credentialed cross-origin requests to the affected Apache Camel HTTP endpoint and read the responses, potentially exposing sensitive information. The issue does not affect integrity or availability but compromises confidentiality by enabling unauthorized data access through cross-origin resource sharing (CORS) misconfiguration.

A fix is available in Apache Camel versions 4.18.5, 4.22.1, and 4.23.0. Users should upgrade to one of these versions to resolve the vulnerability. For users who cannot upgrade immediately, explicitly setting camel.server.cors.origins to a list of allowed origins will mitigate the risk by restricting credentialed cross-origin requests to trusted domains only.