What is the CVSS score of CVE-2026-27172?

CVE-2026-27172 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Apache Camel are affected by CVE-2026-27172?

Apache Camel's camel-consul component (versions 3.0.0-4.14.6 and 4.15.0-4.18.1) contains an unsafe deserialization vulnerability that enables arbitrary code execution within Camel processes if an…. A patch is available.

How to fix or mitigate CVE-2026-27172?

Within 24 hours, enumerate all Apache Camel deployments across the organization and identify which use the camel-consul component with Consul-backed registry configuration, then cross-reference their versions against the known affected ranges. Within 7 days, obtain the patched Camel versions from the Apache vendor advisory, validate the upgrade path in a staging environment, and schedule production deployments with minimal service disruption. Within 30 days, complete the upgrade of all affected Camel deployments to patched versions and perform functional validation of the Consul registry integration.

Apache Camel CVE-2026-27172

EUVD-2026-25815 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-04-27 apache

Deserialization RCE Java Apache Apache Camel

8.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Attacker needs authenticated write access to the Consul KV store (PR:L) reachable over the network (AV:N); the resulting deserialization yields full RCE, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:01 vuln.today

Patch released

Apr 28, 2026 - 19:40 nvd

Patch available

Severity Changed

Apr 28, 2026 - 13:22 NVD

MEDIUM HIGH

CVSS changed

Apr 28, 2026 - 13:22 NVD

6.3 (MEDIUM) 8.8 (HIGH)

CVSS changed

Apr 27, 2026 - 18:22 NVD

6.3 (MEDIUM)

Patch available

Apr 27, 2026 - 12:01 EUVD

EUVD ID Assigned

Apr 27, 2026 - 11:00 euvd

EUVD-2026-25815

CVE Published

Apr 27, 2026 - 09:59 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

19 maven packages depend on org.apache.camel:camel-consul (4 direct, 15 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs.

This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1.

Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.

AnalysisAI

Unsafe Java deserialization in Apache Camel's camel-consul component (ConsulRegistry / ConsulRegistryUtils.deserialize) lets an attacker who can write to the backing Consul KV store achieve arbitrary code execution inside the Camel process. Any deployment using a Consul-backed Camel registry on versions 3.0.0 up to 4.14.6 or 4.15.0 up to 4.18.1 is affected. There is no public exploit identified at time of analysis, EPSS is low (0.08%), and this is a missed instance of the same deserialization class fixed in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data). Apache Camel is a Java-based enterprise integration framework; its camel-consul component can use HashiCorp Consul's key/value store as a bean/registry backend. The class org.apache.camel.component.consul.ConsulRegistry reads Java-serialized byte values from Consul KV and passes them directly to ObjectInputStream.readObject() in the ConsulRegistryUtils.deserialize method, without installing an ObjectInputFilter (JEP 290) allow-list. Because native Java serialization reconstructs arbitrary object graphs and invokes gadget-chain logic during deserialization, any untrusted serialized blob in the KV store becomes executable when Camel performs a registry lookup. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_camel, i.e. the Camel framework itself when configured with the Consul registry backend.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.19.0, which fixes the issue; users on the 4.14.x LTS stream should move to 4.14.6, and users on the 4.18.x stream should move to 4.18.1, per https://camel.apache.org/security/CVE-2026-27172.html. If immediate upgrade is not possible, restrict and authenticate write access to the Consul KV store backing the registry using Consul ACL tokens and network segmentation so untrusted parties cannot inject serialized values (trade-off: requires Consul ACL enablement and may break automation that writes to KV), and where feasible avoid using the Consul registry as a bean store for untrusted or shared Consul clusters. Do not rely on these controls as a permanent substitute for the patched release, since any write path to the KV store re-enables the deserialization sink.