CVE-2026-84180: CWE-209 Generation of Error Message Containing Sensitive Information in Apache Software Foundation Apache Camel

The vulnerability CVE-2026-84180 in Apache Camel's Knative HTTP consumer component causes sensitive internal exception details—including class names, messages, stack traces, and potentially configuration or connection strings—to be returned in HTTP response bodies when an exchange processing failure occurs. This exposure can reveal deployment internals useful for attackers. The affected versions are Apache Camel >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The issue was addressed in Apache Camel 4.18.5, 4.22.1, and 4.23.0 by introducing a muteException option that defaults to true, which suppresses exception details in responses. Users can also mitigate by adding an onException handler to explicitly set the response body, preventing exception leakage.

The vulnerability allows an unauthenticated remote attacker to cause the Knative HTTP consumer to return detailed exception information in response bodies. This information disclosure can reveal internal class names, package names, file system or host names, route structure, and potentially sensitive configuration or connection strings. Such information can facilitate more targeted attacks against the affected deployment. There is no direct impact on integrity or availability reported.

A fix is available by upgrading Apache Camel to version 4.18.5 (for the 4.18.x LTS stream), 4.22.1 (for the 4.22.x LTS stream), or 4.23.0 or later. These versions enable the muteException option by default, which prevents exception details from being returned in HTTP responses. For deployments that cannot upgrade immediately, it is recommended to add an onException handler in the route configuration to explicitly set the response body, ensuring exception details are not leaked to callers.