CVE-2026-85313: CWE-942 Permissive Cross-domain Policy with Untrusted Domains in Apache Software Foundation Apache Camel

This vulnerability involves a permissive cross-domain policy in Apache Camel's Jetty component when the enableCORS option is enabled. By default, enableCORS installs Jetty's CrossOriginFilter with settings that accept requests from any origin and allow credentials, effectively granting credentialed cross-origin access broadly. This behavior can expose sensitive information by allowing web pages from untrusted origins to make credentialed requests and read responses from the affected endpoint. The flaw affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The issue is resolved in versions 4.18.5, 4.22.1, and 4.23.0, where enableCORS no longer grants credentials to unspecified origins. Operators must explicitly list allowed origins or upgrade to a fixed version to mitigate the risk.

The vulnerability allows any origin to make credentialed cross-origin requests to the affected Apache Camel Jetty endpoint and read the responses. This can lead to unauthorized disclosure of sensitive information to untrusted web origins. The impact is limited to information disclosure (confidentiality) without integrity or availability effects. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality impact.

A fix is available in Apache Camel versions 4.18.5, 4.22.1, and 4.23.0. Users should upgrade to one of these versions to resolve the vulnerability. For deployments that cannot upgrade immediately, explicitly configure the CrossOriginFilter parameters to specify allowed origins rather than relying on the enableCORS default settings, which are permissive. This ensures that only trusted origins are granted credentialed cross-origin access.