What is the CVSS score of CVE-2026-43867?

CVE-2026-43867 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-43867?

Apache Camel versions 4.18.0-4.20.x contain a critical Java deserialization vulnerability (CVE-2026-43867, CVSS 9.8) enabling remote code execution in key-management applications; exploitation…. A patch is available.

How to fix or mitigate CVE-2026-43867?

Within 24 hours: Identify all deployments of Apache Camel 4.18.0-4.18.2 and 4.19.0-4.20.x, with priority for instances managing cryptographic keys or secrets; verify which systems have IAM-authenticated access to the backing AWS Secrets Manager secrets. Within 7 days: Apply vendor-released patch per the Apache Camel security advisory for your specific version; consult Apache Camel release notes to determine the appropriate patched version for each deployment. Within 30 days: Confirm patch deployment across all affected instances; review IAM access logs (CloudTrail) for any pre-patch write attempts to the affected Secrets Manager secrets.

Apache Camel CVE-2026-43867

EUVD-2026-41853 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-06 apache

GHSA-7cmx-qjh8-7v3v

Deserialization Hashicorp RCE Apache Apache Camel

9.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Exploitation requires secretsmanager:PutSecretValue write access to the metadata secret, so PR:H over a network-reachable AWS API; successful deserialization yields full code execution, hence C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 20:44 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 20:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 20:22 NVD

9.8 (CRITICAL)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 06, 2026 - 09:45 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.apache.camel:camel-pqc (2 direct, 1 indirect)

Ecosystem-wide dependent count for version 4.18.0.

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component.

The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. A principal who can write to the AWS Secrets Manager secret that holds this metadata (requiring secretsmanager:PutSecretValue on that secret) could store a crafted serialized object that is deserialized during normal key-lifecycle operations, potentially leading to code execution in the context of the application that manages the keys. This is the same underlying defect, in the same code path and remediated by the same fix, as CVE-2026-46590, which was reported independently and additionally covers the HashiCorp Vault and file-based sibling managers; both are incomplete-remediation follow-ons to CVE-2026-40048 (CAMEL-23200). This issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0.

Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the AWS Secrets Manager secret that holds the camel-pqc key metadata so that only the application’s own identity holds secretsmanager:PutSecretValue on it (least-privilege IAM), and keep the PQC key material in a secret separate from any data that less-trusted principals can write.

Articles & Coverage 2

News 3 New HashiCorp Vulnerabilities - 1 Critical, 2 High Severity Jul 07, 2026 News 3 New HashiCorp Vulnerabilities - 1 Critical, 2 High Severity Jul 06, 2026

AnalysisAI

Java object deserialization in the Apache Camel camel-pqc component allows code execution in the key-management application when an attacker who can write to the backing AWS Secrets Manager secret stores a malicious serialized payload. The flaw affects Apache Camel 4.18.0-4.18.2 and 4.19.0-4.20.x, where AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() calls a raw ObjectInputStream.readObject() with no class filter, so gadget side effects fire before the KeyMetadata cast. Rated CVSS 9.8 by Apache, but exploitation genuinely requires IAM write access to the specific secret; there is no public exploit identified at time of analysis and EPSS is low at 0.19% (8th percentile).