Apache Camel CVE-2026-40473

Exploitation requires the target application to (1) use camel-mina as a TCP or UDP consumer with a network-reachable listener, and (2) request conversion of the inbound body to ObjectInput - specifically via getBody(ObjectInput.class) or an @Body ObjectInput parameter - which triggers MinaConverter.toObjectInput and the unguarded ObjectInputStream. This ObjectInput conversion is NOT Camel's default behavior, so routes that consume bytes/strings without requesting ObjectInput are not exploitable. Successful RCE also depends on a usable deserialization gadget chain existing on the application classpath. Limiting factors: the vulnerable conversion must be explicitly configured (non-default), the MINA port must be reachable by the attacker, and no code execution occurs without a viable gadget in the deployed dependencies; no user interaction is required and, per the description, the attacker needs only network access to the listening port.

Signals are mixed and should be weighed together. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) reflects network-reachable, high-impact code execution, and SSVC rates Technical Impact as 'total' - consistent with full RCE. However, SSVC also rates Exploitation as 'none' and Automatable as 'no', the vulnerability is NOT in CISA KEV, and EPSS is only 0.08% (24th percentile), indicating low predicted near-term mass exploitation. The key limiting factor is that exploitation requires a specific application configuration: the Camel route must use camel-mina as a consumer AND request conversion to ObjectInput (e.g., getBody(ObjectInput.class) or @Body ObjectInput). This is not a default Camel behavior, so the real-world exposed population is a subset of camel-mina users. Note a discrepancy worth verifying: the official vector uses PR:L (authenticated), yet the description describes an unauthenticated network attacker simply sending bytes to the listening MINA port - the 'privilege' more accurately reflects the required non-default app configuration than an attacker credential. Publicly available exploit code raises the practical priority for anyone matching the vulnerable config, so treat as high-priority for confirmed camel-mina+ObjectInput deployments and lower priority elsewhere.

An organization runs a Camel integration that listens on a MINA TCP port and deserializes inbound messages to ObjectInput. An attacker with network reachability to that port sends a crafted Java serialized object built around a gadget chain present on the app's classpath; when Camel calls readObject(), the chain executes and the attacker gains code execution in the application's context. Publicly available exploit code lowers the skill barrier for weaponizing this against exposed, misconfigured consumers.