CVE-2026-85316: CWE-1220 Insufficient Granularity of Access Control in Apache Software Foundation Apache Camel
Description
Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with the string proxy, rather than by matching the path exactly. Any endpoint whose path merely begins with those characters - proxyStatus, proxy-config, proxying and so on - therefore became a proxy endpoint without the route author asking for it. A proxy endpoint forwards requests onward, so an endpoint that was intended to serve its own content instead relays traffic on behalf of whoever calls it, which is both a request forgery primitive and an exposure of whatever the forwarding path can reach. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Proxy mode is now selected by an exact path match rather than by prefix. For deployments that cannot upgrade immediately, rename any endpoint path that begins with proxy but is not intended to be a proxy.
CVSS v3.1
Score 4.8medium
Affected software
Apache Software Foundation
Apache Camel
pkg:maven/Apache Software Foundation/org.apache.camel:camel-platform-httpRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Apache Camel Platform HTTP component incorrectly identifies proxy mode endpoints by prefix matching the path with 'proxy' instead of exact matching. This flaw causes endpoints with paths starting with 'proxy' to unintentionally operate as proxy endpoints, forwarding requests on behalf of callers. This behavior can lead to request forgery and exposure of internal forwarding paths. The vulnerability affects Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1. The issue is resolved in versions 4.18.5 and 4.22.1 by changing proxy mode selection to exact path matching. Users are advised to upgrade to 4.23.0 or the respective LTS fixes. Temporary mitigation includes renaming endpoint paths beginning with 'proxy' if they are not meant to be proxies.
Potential Impact
This vulnerability allows unintended endpoints to act as proxy endpoints, forwarding requests on behalf of attackers. This can enable request forgery and expose internal resources accessible via the forwarding path. The impact is limited to confidentiality and integrity with no availability impact. The CVSS score is 4.8 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.
Mitigation Recommendations
Upgrade Apache Camel to version 4.18.5 if using the 4.18.x LTS stream, or to 4.22.1 if using the 4.22.x LTS stream. Alternatively, upgrade to 4.23.0 or later where the issue is fully resolved. For deployments unable to upgrade immediately, rename any endpoint paths that begin with 'proxy' but are not intended to be proxy endpoints to prevent unintended proxy behavior.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-03T16:47:12.426Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad5f5a02cdf04f65643555b
Added to database: 10/19/2026, 10:49:04 UTC
Last enriched: 10/19/2026, 11:04:38 UTC
Last updated: 10/19/2026, 19:06:47 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.