CVE-2026-85245: CWE-488 Exposure of Data Element to Wrong Session in Apache Software Foundation Apache Camel

The vulnerability CVE-2026-85245 in Apache Camel's Thrift component occurs because the unmarshalling process uses a shared default instance of the target type instead of creating a fresh copy for each message. This shared instance retains state from previous messages, allowing data from one sender to be exposed to others, especially in multi-tenant environments. The flaw affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The issue is resolved in versions 4.18.5 and 4.22.1 by changing the unmarshalling to deserialize into a new instance per exchange, preventing state carryover. As a temporary mitigation, users can copy the unmarshalled object immediately after deserialization to avoid retaining references to the shared instance.

This vulnerability can lead to unauthorized disclosure of data between different sessions or tenants sharing the same route in Apache Camel. Specifically, data from one sender can be visible to another, violating data confidentiality. There is no impact on integrity or availability reported. The CVSS 3.1 base score is 5.9 (medium severity), reflecting network attack vector with high complexity and no privileges required, causing confidentiality impact only.

A fix is available in Apache Camel versions 4.18.5 and 4.22.1. Users should upgrade to these versions or later to resolve the issue. For those who cannot upgrade immediately, a temporary mitigation is to copy the unmarshalled body into a new instance immediately after deserialization and avoid retaining references to the shared object returned by the Thrift data format.