CVE-2026-85300: CWE-276 Incorrect Default Permissions in Apache Software Foundation Apache Camel

Apache Camel versions >=4.12.0 <4.18.5 and >=4.19.0 <4.22.1 have a CWE-276 Incorrect Default Permissions vulnerability in the PQC component. When writing generated private key material to disk, the component used the process default umask permissions rather than restricting files to owner-only access. On systems with permissive umask settings allowing group or world read access, private keys could be read by other local users. This local exposure can lead to complete compromise of cryptographic operations relying on those keys. The issue is fixed in Apache Camel 4.18.5, 4.22.1, and 4.23.0 by enforcing owner-only permissions on key files. Users unable to upgrade immediately should restrict directory traversal and tighten umask. Any keys written with permissive permissions should be considered compromised and rotated.

The vulnerability allows local users on the host to read private key material if the system umask permits group or world read access. This compromises the confidentiality of private keys, enabling an attacker with local access to defeat all signature and key exchange protections relying on those keys. The impact is limited to local attackers, not remote adversaries, resulting in a medium severity rating. Complete cryptographic compromise occurs if exploited.

A fix is available in Apache Camel versions 4.18.5, 4.22.1, and 4.23.0, which enforce owner-only permissions on key material files. Users should upgrade to these versions to remediate the vulnerability. For deployments unable to upgrade immediately, it is recommended to place the key directory on a path accessible only by the service account and to tighten the process umask to restrict file permissions. Any key material previously written with permissive permissions should be treated as exposed and rotated promptly.