CVE-2026-85260: CWE-532 Insertion of Sensitive Information into Log File in Apache Software Foundation Apache Camel
Description
Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log. It defaulted to true, so a deployment that did nothing logged protected health information out of the box. Two further paths wrote payload content to the log regardless of the setting, so even an operator who had turned logPhi off was still exposed on those paths. MLLP is used to carry HL7 clinical messages, so the content concerned is patient data, and it reached ordinary application logs where it is subject to whatever retention, aggregation and access the deployment applies to logs generally rather than to clinical records. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. logPhi now defaults to false and is honoured on the paths that previously ignored it. This is a changed default: a deployment that relied on payload logging must now set logPhi=true explicitly. Because the upgrade guide for a change like this lives on the main branch only, operators upgrading within the 4.18.x or 4.22.x lines should treat this advisory as the notice of that change. For deployments that cannot upgrade immediately, set logPhi=false and be aware that two paths will continue to log payload content until the fix is applied; restrict access to the logs accordingly.
CVSS v3.1
Score 5.5medium
Affected software
Apache Software Foundation
Apache Camel
pkg:maven/Apache Software Foundation/org.apache.camel:camel-mllpRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-85260 in Apache Camel's MLLP component involves the insertion of sensitive HL7 payload data into application logs. The logPhi option, which governs whether HL7 payload content is logged, defaulted to true, causing protected health information to be logged by default. Furthermore, two additional code paths logged payload data regardless of the logPhi setting, exposing patient data in logs. This affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The issue is fixed in Apache Camel 4.23.0, 4.18.5, and 4.22.1, where logPhi defaults to false and is honored on all paths. Deployments relying on payload logging must explicitly set logPhi=true after upgrading. For those unable to upgrade immediately, setting logPhi=false reduces exposure, but two paths still log payloads, so log access should be restricted.
Potential Impact
The vulnerability leads to unintended logging of protected health information (PHI) contained in HL7 clinical messages to ordinary application logs. This exposes sensitive patient data to anyone with access to these logs, which may not have the same protections as clinical records. The confidentiality of patient data is compromised, but there is no indication of integrity or availability impact. The CVSS score of 5.5 (medium severity) reflects the local attack vector and low complexity, with high confidentiality impact but no integrity or availability impact.
Mitigation Recommendations
A fix is available in Apache Camel versions 4.18.5, 4.22.1, and 4.23.0. Users should upgrade to one of these versions to resolve the issue. The fix changes the default of the logPhi option to false and ensures it is respected on all code paths. Deployments that require logging HL7 payloads must explicitly set logPhi=true after upgrading. For deployments unable to upgrade immediately, set logPhi=false to reduce exposure and restrict access to application logs, as two code paths will continue to log payload content until the fix is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-03T16:35:42.561Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad5f59d2cdf04f656435538
Added to database: 10/19/2026, 10:49:01 UTC
Last enriched: 10/19/2026, 11:18:21 UTC
Last updated: 10/19/2026, 17:19:12 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.