CVE-2026-85257: CWE-209 Generation of Error Message Containing Sensitive Information in Apache Software Foundation Apache Camel

This vulnerability (CVE-2026-85257) affects Apache Camel CXF component versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer throws an exception not declared in the service contract, the CXF framework copies the exception message into the SOAP faultstring and can include the stack trace in the fault detail. This behavior leaks sensitive internal information such as class and package names and exception messages to external callers. Declared faults annotated with @WebFault are exempt as they are part of the published contract. The vulnerability is addressed in Apache Camel 4.18.5 and 4.22.1 by introducing a muteException consumer option that replaces undeclared exceptions with a generic fault without sensitive details. Setting muteException to false restores the previous behavior. For those who cannot upgrade immediately, declaring exceptions and mapping undeclared exceptions to declared faults in an onException handler can prevent sensitive information leakage.

An external attacker able to trigger an undeclared exception in a CXF SOAP consumer route can receive detailed internal error information in the SOAP fault response. This information includes class names, package names, exception messages, and stack traces, which may aid in reconnaissance or further attacks. The vulnerability does not affect declared faults and does not impact confidentiality beyond information disclosure. There is no impact on integrity or availability.

A fix is available in Apache Camel versions 4.18.5 and 4.22.1 and later. Users should upgrade to these versions to resolve the issue. The muteException consumer option, enabled by default in fixed versions, suppresses sensitive exception details in SOAP faults for undeclared exceptions. For deployments that cannot upgrade immediately, users should declare all exceptions the service is allowed to report and map any other failures to declared exceptions using an onException handler to prevent undeclared exceptions from reaching the fault response.