CVE-2026-85243 is a vulnerability in Apache Camel's Crypto PGP component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The issue arises because the unmarshal() function only verifies the modification detection code for OpenPGP symmetrically encrypted integrity protected data packets, but older packet types lack this integrity check. This allows an attacker who can modify messages in transit to bypass integrity validation. Apache Camel 4.23.0, 4.18.5, and 4.22.1 include fixes that add a requireIntegrityProtection option to enforce integrity checks on incoming messages.
CVE-2026-84181 is an improper authentication vulnerability in the Apache Camel Shiro component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The flaw allows credential verification to be skipped if a subject bound to the current thread has the same principal as the incoming exchange, due to thread reuse in the Camel exchange pool. This can enable an attacker to bypass password verification by sending a request with a principal already in use. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1 and later.
CVE-2026-84180 is a vulnerability in the Apache Camel Knative component where error messages generated on consumer-side failures include sensitive information such as exception class names, messages, stack traces, and internal deployment details. This information disclosure can aid attackers in crafting targeted attacks. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Fixed versions are 4.18.5 and 4.22.1, which introduce a muteException option defaulting to true to suppress exception details in responses. Users unable to upgrade immediately can mitigate by adding an onException handler to control response bodies.
CVE-2026-84178 is a Cross-Site Request Forgery (CSRF) vulnerability in the Apache Camel OAuth component affecting versions from 4.11.0 before 4.18.5 and from 4.19.0 before 4.22.1. The flaw allows an attacker to redeem an authorization code obtained in any browser at the callback, associating it with the victim's session, which can silently sign the victim in as the attacker-controlled identity. This also enables an open redirect from a trusted origin due to unvalidated post-authentication redirect targets. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1 and later.
CVE-2026-84176 is a medium severity vulnerability in Apache Camel's Platform HTTP Vertx component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The issue arises because the Access-Control-Allow-Credentials header is set to true on all responses with an Origin header, even when the origin is not allowed, enabling credentialed cross-origin requests from any origin. This permissive cross-domain policy can allow a malicious web page to make credentialed requests and read responses from the Camel endpoint. The vulnerability is fixed in Apache Camel versions 4.18.5 and 4.22.1. Users unable to upgrade immediately can mitigate by explicitly setting allowed origins in the configuration.
CVE-2026-83531 is a code injection vulnerability in Apache Camel affecting versions from 4.4.0 before 4.18.5 and from 4.19.0 before 4.22.1. It arises from the dynamic-router-control endpoint allowing untrusted expressions to be compiled and evaluated with Camel process privileges. Exploitation requires the ability to send messages to a transport routed to this endpoint, with no additional authentication needed. The issue is fixed in versions 4.18.5, 4.22.1, and later 4.23.0.
CVE-2026-80344 is a Server-Side Request Forgery (SSRF) vulnerability in the Apache Camel AS2 component. The flaw allows a remote attacker to specify an arbitrary host for asynchronous Message Disposition Notification (MDN) delivery, potentially causing the server to connect to internal or unauthorized hosts. This can expose internal network resources and leak credentials used for MDN delivery. The vulnerability affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Fixed versions are 4.18.5 and 4.22.1, and 4.23.0 is the latest version that addresses the issue. Mitigation includes upgrading to fixed versions or restricting outbound connectivity and credential usage for MDN delivery.
CVE-2026-80343 is a high-severity vulnerability in Apache Camel's Netty HTTP component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The issue arises from inconsistent case sensitivity handling between the security constraint and request routing, allowing an attacker to bypass security constraints by altering the case of characters in the request path. This bypass enables access to protected routes without credentials or special configuration. Fixed versions are 4.18.5 and 4.22.1, which align case sensitivity rules between the constraint and routing. Until upgrading, users should place authorization checks before the Camel consumer, such as in a reverse proxy that normalizes request paths.
Improper Authentication vulnerability in Apache Camel OAuth component.
This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.
The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.
CVE-2026-79986 is a path traversal vulnerability in Apache Camel's Azure Files component and other remote-file consumers. The flaw allows an attacker controlling the remote server or an on-path attacker to craft directory listings with path segments that escape the configured polling directory. This enables unauthorized reading, deletion, or renaming of files outside the intended directory using the endpoint's credentials. The vulnerability affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Fixed versions are 4.18.5 and 4.22.1, with 4.23.0 recommended for later streams.
CVE-2026-79985 is a path traversal vulnerability in the Apache Camel SMB component affecting versions from 4.2.0 before 4.18.5 and from 4.19.0 before 4.22.1. The flaw allows an attacker controlling the remote server or an on-path attacker to manipulate directory listings to cause Apache Camel to access files outside the intended polling directory. This can lead to unauthorized file retrieval, deletion, or renaming using the endpoint's credentials. The vulnerability arises because Apache Camel does not properly normalize or validate remote file paths before performing operations. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1.
CVE-2026-79984 is a path traversal vulnerability in the Apache Camel Mina SFTP component affecting versions from 4.18.0 before 4.18.5 and from 4.19.0 before 4.22.1. The vulnerability arises because the component concatenates directory paths with file names from the remote server without proper normalization or containment checks, allowing an attacker to access files outside the intended directory. This can lead to unauthorized reading, deletion, or renaming of files on the remote server. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1.
CVE-2026-79983 is a path traversal vulnerability in the Apache Camel FTP component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The vulnerability allows an attacker controlling the FTP server or an on-path attacker to craft directory listings with file names that escape the configured polling directory. This leads to unauthorized read, delete, or rename operations on files outside the intended directory using the endpoint's credentials. The issue affects ftp, ftps, and sftp schemes. The vulnerability is fixed in Apache Camel versions 4.18.5 and 4.22.1.
CVE-2026-78165 is a deserialization of untrusted data vulnerability in the Apache Camel Spring Redis component affecting versions from 2.11.0 before 4.18.5 and from 4.19.0 before 4.22.1. The vulnerability arises because the component uses a default Java serialization mechanism without applying any object input filtering, allowing arbitrary serialized objects to be deserialized and their readObject methods executed. This occurs before any route logic can inspect the message, exposing the system to potential remote code execution if an attacker can publish messages to subscribed Redis channels. The issue is fixed in Apache Camel versions 4.18.5, 4.22.1, and later 4.23.0. Mitigations include upgrading to fixed versions, setting JVM-wide serialization filters, configuring non-Java serializers, and restricting Redis access.
CVE-2026-78164 is a high-severity vulnerability in Apache Camel HTTP, Netty HTTP, Undertow, and Vert.x HTTP components. It involves improper neutralization of special elements used in a template engine, allowing inbound messages to override endpoint URIs via headers that are processed through a property-placeholder resolution mechanism. This can lead to exposure of sensitive information and unintended configuration or bean method invocation. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Fixed versions are 4.18.5 and 4.22.1, with 4.23.0 recommended for the latest fixes. Mitigations include upgrading to fixed versions or stripping override headers at the trust boundary, or setting skipControlHeaders=true on camel-http endpoints. The vulnerability is not mitigated by bridgeEndpoint=true or percent-encoding placeholder delimiters.
CVE-2026-78163 is a Server-Side Request Forgery (SSRF) vulnerability in the Apache Camel Docling component affecting versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.1. The vulnerability arises because the DoclingProducer interprets message body prefixes to decide how to process them, allowing untrusted input to trigger remote URL fetches or local file reads without explicit configuration. This implicit mode selection can lead to unauthorized access to remote or local resources. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1. Users unable to upgrade immediately should avoid routing external message bodies into Docling endpoints or use typed bodies or headers to prevent prefix interpretation.
CVE-2026-78162 is a critical deserialization of untrusted data vulnerability in Apache Camel affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The flaw arises because certain Hazelcast instances created internally by Camel do not apply Java deserialization filters, allowing an attacker with access to the Hazelcast cluster to cause arbitrary Java objects to be deserialized. This can lead to remote code execution. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1, and users are strongly advised to upgrade. Alternative mitigations include supplying explicit Hazelcast configurations with deserialization filters, injecting pre-built Hazelcast instances, setting JVM-wide serialization filters, and enabling Hazelcast cluster authentication and TLS.
A security vulnerability has been identified in michaelrsweet mxml version 4.0.5 and several other specific versions. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity level. It requires network access with low attack complexity and privileges, and user interaction is needed. The impact includes limited confidentiality, integrity, and availability losses. No public exploit or known active exploitation has been reported. The affected versions include multiple specific builds from 2.7-1 through 4.0.4-6.
CVE-2026-98866 is a use-after-free vulnerability in the Linux kernel scheduler related to the sched_cache_grp pointer in task_struct. The flaw was addressed by introducing a dedicated sched_cache_grp pointer in each task_struct to decouple scheduler hot-path accesses from the mm_struct, preventing use-after-free conditions during memory management transitions such as fork and exec. This fix involves reference counting changes and scheduler code updates to safely manage cache group references.
CVE-2026-98865 is a vulnerability in the Linux kernel's sched_ext component where ops.dequeue() is called while holding a DSQ lock, leading to potential self-deadlocks in BPF schedulers. The issue arises because ops.dequeue() is invoked with the source user DSQ's lock still held on certain paths, causing recursion lock dependency checks to fail. The flaw has been addressed by moving the ops.dequeue() call after the DSQ unlock on all affected paths, ensuring the callback is invoked exactly once.