CVE-2026-85315: CWE-209 Generation of Error Message Containing Sensitive Information in Apache Software Foundation Apache Camel

The vulnerability CVE-2026-85315 in Apache Camel's gRPC component arises from the inclusion of detailed exception messages in the gRPC status description sent to clients when a route behind a gRPC consumer fails. Unlike the status cause, which remains local, the description is transmitted externally, allowing an attacker who can provoke failures to obtain sensitive internal information such as class and package names, file paths, hostnames, and connection details. This issue affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The problem is addressed by upgrading to Apache Camel 4.18.5 or 4.22.1 for respective LTS streams, or 4.23.0 for the latest release. Additionally, the 'muteException' consumer option, which defaults to true, replaces detailed messages with a generic description, preventing sensitive data leakage. For environments unable to upgrade immediately, mapping failures to explicit statuses in an onException handler can prevent exception messages from being copied into the status description.

An external client able to trigger a failure in a gRPC route can receive detailed internal error messages that disclose sensitive information such as class names, package names, file paths, hostnames, and connection details. This information disclosure could aid an attacker in further reconnaissance or targeted attacks. The vulnerability does not impact integrity or availability, only confidentiality.

Upgrade Apache Camel to version 4.18.5 if using the 4.18.x LTS stream, to 4.22.1 if using the 4.22.x LTS stream, or to 4.23.0 for the latest release to fully resolve the issue. The 'muteException' consumer option is enabled by default and replaces detailed exception messages with a generic description, mitigating the vulnerability. For deployments that cannot upgrade immediately, configure an onException handler to map failures to explicit statuses, preventing exception messages from being included in gRPC status descriptions.