CVE-2026-90885 is an XML External Entity (XXE) vulnerability in the Apache Camel Saxon component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2. The vulnerability arises because the default Saxon Configuration used by the XQueryBuilder allows DOCTYPE declarations and external entity resolution when the message body is already a javax.xml.transform.Source. This can lead to disclosure of files readable by the Camel process and can cause the process to issue network requests to attacker-controlled hosts. Fixed versions are 4.18.5, 4.22.2, and 4.23.0.