EUVD-2026-41853
GHSA-7cmx-qjh8-7v3v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 06, 2026
Java object deserialization in the Apache Camel camel-pqc component allows code execution in the key-management application when an attacker who can write to the backing AWS Secrets Manager secret stores a malicious serialized payload. The flaw affects Apache Camel 4.18.0-4.18.2 and 4.19.0-4.20.x, where AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() calls a raw ObjectInputStream.readObject() with no class filter, so gadget side effects fire before the KeyMetadata cast. Rated CVSS 9.8 by Apache, but exploitation genuinely requires IAM write access to the specific secret; there is no public exploit identified at time of analysis and EPSS is low at 0.19% (8th percentile).
Earlier versions of this analysis (2)
Insecure Java deserialization in the Apache Camel camel-pqc component (versions 4.18.0 before 4.18.3 and 4.19.0 before 4.21.0) allows a principal who can write to the AWS Secrets Manager secret holding post-quantum key metadata to achieve potential remote code execution. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() Base64-decodes and calls ObjectInputStream.readObject() with no ObjectInputFilter or class allow-list, so gadget-chain side effects run during routine key-lifecycle operations before the KeyMetadata cast. No public exploit is identified at time of analysis and the EPSS score is low (0.19%), but this is an incomplete-remediation follow-on to CVE-2026-40048 and a sibling of CVE-2026-46590.
Unsafe Java deserialization in Apache Camel's camel-pqc component (versions 4.18.0-4.18.2 and 4.19.0-4.20.x) enables arbitrary code execution when a sufficiently privileged AWS IAM principal can write to the Secrets Manager secret holding PQC key metadata. The AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() method invokes ObjectInputStream.readObject() without an ObjectInputFilter or class allow-list, allowing a crafted gadget payload stored in the secret to execute before the type-check cast. No public exploit or CISA KEV listing has been identified at time of analysis; however, the vendor has confirmed the defect and released fixes in 4.18.3 and 4.21.0, noting this is an incomplete-remediation follow-on to CVE-2026-40048 (CAMEL-23200).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Apache Camel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation requires secretsmanager:PutSecretValue write access to the metadata secret, so PR:H over a network-reachable AWS API; successful deserialization yields full code execution, hence C/I/A:H.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component.
The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. A principal who can write to the AWS Secrets Manager secret that holds this metadata (requiring secretsmanager:PutSecretValue on that secret) could store a crafted serialized object that is deserialized during normal key-lifecycle operations, potentially leading to code execution in the context of the application that manages the keys. This is the same underlying defect, in the same code path and remediated by the same fix, as CVE-2026-46590, which was reported independently and additionally covers the HashiCorp Vault and file-based sibling managers; both are incomplete-remediation follow-ons to CVE-2026-40048 (CAMEL-23200). This issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0.
Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the AWS Secrets Manager secret that holds the camel-pqc key metadata so that only the application’s own identity holds secretsmanager:PutSecretValue on it (least-privilege IAM), and keep the PQC key material in a secret separate from any data that less-trusted principals can write.
Blast Radius
ecosystem impact- 3 maven packages depend on org.apache.camel:camel-pqc (2 direct, 1 indirect)
Ecosystem-wide dependent count for version 4.18.0.
Articles & Coverage 2
Executive ViewAI
Apache Camel versions 4.18.0-4.20.x contain a critical Java deserialization vulnerability (CVE-2026-43867, CVSS 9.8) enabling remote code execution in key-management applications; exploitation requires write access to AWS Secrets Manager secrets, no public exploit identified at time of analysis, and real-world risk is significantly lower than the CVSS rating reflects (EPSS 0.2%, 8th percentile). Vendor patch is available. Organizations running affected versions in cryptographic key management roles must inventory systems within 24 hours and deploy patches within 7 days.
Within 24 hours: Identify all deployments of Apache Camel 4.18.0-4.18.2 and 4.19.0-4.20.x, with priority for instances managing cryptographic keys or secrets; verify which systems have IAM-authenticated access to the backing AWS Secrets Manager secrets. Within 7 days: Apply vendor-released patch per the Apache Camel security advisory for your specific version; consult Apache Camel release notes to determine the appropriate patched version for each deployment. Within 30 days: Confirm patch deployment across all affected instances; review IAM access logs (CloudTrail) for any pre-patch write attempts to the affected Secrets Manager secrets.
Apply vendor patch. Pending patch deployment, implement least-privilege IAM policies that restrict write access to AWS Secrets Manager secrets to only the specific roles and principals required for legitimate secret rotation and lifecycle management; enable CloudTrail logging and alerting for write operations against Secrets Manager.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Apache Camel
View allRemote code execution in Apache Camel's camel-coap component (versions 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0)
Unsafe Java deserialization in Apache Camel's camel-infinispan component allows arbitrary code execution when the ProtoS
Unauthenticated remote code execution affects the camel-hazelcast component of Apache Camel 4.0.0 through 4.18.4 and 4.1
Header-injection in the Apache Camel camel-atmosphere-websocket producer lets an external sender hijack WebSocket messag
Header-filter bypass in the Apache Camel Undertow component (4.11.0-4.14.8, 4.15.0-4.18.3, and 4.19.0-4.21.x) lets remot
Remote code execution in Apache Camel 3.18.0-4.14.5 and 4.15.0-4.18.1 stems from CXF and Knative HeaderFilterStrategy im
Message header injection in Apache Camel's camel-mail component (3.0.0 before 4.14.6 and 4.15.0 before 4.18.1) lets an a
Remote code execution via unsafe Java deserialization affects the camel-pqc component of Apache Camel 4.18.0-4.18.2 and
Unsafe Java deserialization in Apache Camel's camel-consul component (ConsulRegistry / ConsulRegistryUtils.deserialize)
Unauthenticated deserialization of attacker-controlled messages in Apache Camel's camel-jgroups consumer can lead to rem
Expression language injection in the Apache Camel dynamic-router-control endpoint allows a party who can place a message
Deserialization of untrusted data in the Apache Camel Spring Redis component (camel-spring-redis) allows an authenticate
Exploit-DB