CVE-2026-85247: CWE-295 Improper Certificate Validation in Apache Software Foundation Apache Camel
Description
Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on without also configuring a truststore therefore obtained an encrypted connection with no peer authentication, which an attacker positioned on the network path can terminate and read. The dangerous state is reached by omission rather than by an explicit opt-in, which is what makes it a framework defect: turning TLS on should not be the thing that turns certificate validation off. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. With no truststore configured the trust options are now left unset so the JVM default trust anchors apply, the same fallback SSLContextParameters and the rest of Camel use. Trusting every certificate is now reached only by asking for it explicitly through the trust.all property, which remains available for development against a cluster with a self-signed certificate. For deployments that cannot upgrade immediately, configure a truststore explicitly wherever SSL is enabled. After upgrading, a deployment that was relying on the implicit trust-all behaviour must either configure a truststore or set the trust.all property deliberately.
CVSS v3.1
Score 5.9medium
Affected software
Apache Software Foundation
Apache Camel
pkg:maven/Apache Software Foundation/org.apache.camel:camel-knativeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Apache Camel's Knative HTTP client causes improper certificate validation when SSL is enabled but no truststore is configured. Instead of using the JVM's default trust anchors, the client falls back to trusting all certificates, effectively disabling peer authentication. This allows a man-in-the-middle attacker to terminate and read encrypted connections. The flaw is due to a default fallback behavior triggered by omission, not explicit opt-in. The issue affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The fix, available in versions 4.18.5, 4.22.1, and 4.23.0, changes the fallback to use JVM default trust anchors unless trust.all is explicitly set to trust all certificates. Deployments that cannot upgrade immediately should configure a truststore explicitly to avoid insecure fallback.
Potential Impact
The vulnerability allows an attacker positioned on the network path to intercept and read encrypted traffic by exploiting the lack of proper certificate validation when SSL is enabled without a configured truststore. This compromises confidentiality but does not affect integrity or availability. The issue arises from a framework defect where enabling TLS unintentionally disables certificate validation unless a truststore is configured.
Mitigation Recommendations
A fix is available in Apache Camel versions 4.18.5, 4.22.1, and 4.23.0. Users should upgrade to one of these versions to resolve the issue. For deployments that cannot upgrade immediately, explicitly configure a truststore wherever SSL is enabled to ensure proper certificate validation. After upgrading, if a deployment relied on the implicit trust-all behavior, it must either configure a truststore or explicitly set the trust.all property to maintain that behavior.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-03T16:24:48.857Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad5f59d2cdf04f656435531
Added to database: 10/19/2026, 10:49:01 UTC
Last enriched: 10/19/2026, 11:18:42 UTC
Last updated: 10/19/2026, 19:06:46 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.