CVE-2026-85246: CWE-209 Generation of Error Message Containing Sensitive Information in Apache Software Foundation Apache Camel

The vulnerability CVE-2026-85246 in Apache Camel Mina component involves the generation of error messages containing sensitive information (CWE-209). When an exchange processing fails, the Mina consumer sends the exception object back to the remote peer over the socket. This includes the exception's class name, message, and nested causes, potentially exposing internal deployment details such as class and package names, file paths, hostnames, and connection details. This behavior occurs in Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The issue is resolved in Apache Camel 4.18.5 and 4.22.1 by introducing a muteException consumer option that suppresses detailed exception information in responses, replacing it with a generic exception. Users unable to upgrade immediately can mitigate by adding an onException handler to explicitly set the reply body, preventing exception details from being sent to remote peers.

The vulnerability allows a remote peer who can provoke a failure in the Mina consumer to receive detailed internal exception information. This can disclose sensitive deployment details such as class names, package names, file paths, hostnames, and connection information. While it does not allow code execution or denial of service, the information disclosure can aid attackers in reconnaissance and further attacks.

A fix is available in Apache Camel versions 4.18.5 and 4.22.1 and later. Users should upgrade to these versions to resolve the issue. The fix introduces a muteException option (default true) that suppresses sensitive exception details in error responses. For environments where immediate upgrade is not possible, users can add an onException handler in their routes to explicitly set the reply body, preventing the Mina consumer from sending exception details to remote peers.