CVE-2026-85296: CWE-488 Exposure of Data Element to Wrong Session in Apache Software Foundation Apache Camel
Description
Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined to the request being processed. Where a deployment serves more than one trading partner, concurrent or successive requests could therefore observe each other's material, and a Message Disposition Notification could be signed with the key of a partner other than the one the receipt was for. The result is cross-partner key confusion: a receipt attributable to the wrong partner, and one partner's signing material used while handling another partner's exchange. AS2 deployments are typically multi-partner by design, so the condition is reached by ordinary concurrent traffic rather than by anything the attacker must arrange. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Per-request signing keys are now confined to the request being processed in ResponseMDN. For deployments that cannot upgrade immediately, run a separate Camel context per trading partner so that no signing material is shared between them.
CVSS v3.1
Score 6.5medium
Affected software
Apache Software Foundation
Apache Camel
pkg:maven/Apache Software Foundation/org.apache.camel:camel-as2Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-85296 in Apache Camel AS2 component arises because signing material for individual requests was stored in shared state accessible across requests rather than being confined to the request being processed. This flaw allows concurrent or successive requests in multi-partner deployments to observe each other's signing material, resulting in cross-partner key confusion. Consequently, a Message Disposition Notification (MDN) could be signed with the key of a different partner than intended, causing receipt attribution errors and misuse of signing keys. The issue affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The Apache Software Foundation fixed this by confining per-request signing keys to the request being processed in ResponseMDN starting with versions 4.18.5 and 4.22.1, with a further upgrade to 4.23.0 recommended. As a temporary mitigation, running separate Camel contexts per trading partner prevents sharing of signing material.
Potential Impact
The vulnerability can lead to exposure of signing material across different trading partners in AS2 deployments, causing cross-partner key confusion. This means that a receipt (MDN) could be signed with the wrong partner's key, potentially undermining the integrity and non-repudiation of message exchanges. The impact is confidentiality loss of signing material and integrity confusion, rated as high confidentiality impact and low integrity impact, with no availability impact.
Mitigation Recommendations
A fix is available in Apache Camel versions 4.18.5 and 4.22.1, with a recommended upgrade to 4.23.0. Users should upgrade to these fixed versions to resolve the vulnerability. For deployments that cannot upgrade immediately, it is advised to run a separate Camel context per trading partner to isolate signing material and prevent cross-request exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-03T16:37:54.485Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad5f5a02cdf04f656435553
Added to database: 10/19/2026, 10:49:04 UTC
Last enriched: 10/19/2026, 11:05:09 UTC
Last updated: 10/19/2026, 19:06:46 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.