EUVD-2026-41866
GHSA-5g68-f6xg-vf2r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Camel endpoint
-
ExploitSend crafted malformed input
-
ExecutionBypass improper input validation
-
ImpactDisclose sensitive data or alter processing
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires network reachability to an Apache Camel route/endpoint that processes attacker-supplied input, on a vulnerable version (through 4.14.7, 4.15.0-4.18.2, or 4.19.0-4.20.0). Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed and complexity is low (AC:L), so default remote exposure of an affected component is sufficient. The main limiting factor is that the terse advisory does not name the specific vulnerable component, protocol, or route type, so realistic exposure depends on which Camel components a deployment actually exposes to untrusted networks - internal-only or gateway-fronted Camel instances are substantially less reachable. Impact is bounded to Low (C:L/I:L/A:L), i.e. partial information disclosure rather than full compromise. |
| Impact | The signals are moderate and internally consistent rather than alarming. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3) indicates a remotely reachable, low-complexity, unauthenticated issue, but with only Low impact to confidentiality, integrity, and availability and no scope change - meaning partial information disclosure rather than full compromise or code execution. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vulnerability is not in CISA KEV (no confirmed active exploitation) and no proof-of-concept was referenced, so this is a real-but-not-emergency priority: patch on a normal-to-expedited cycle. A key caveat: the public description is extremely terse ('Improper Input Validation vulnerability in Apache Camel') and does not name the affected component or route type, so the true blast radius cannot be confirmed from available data - the actual risk depends on which Camel components a given deployment exposes. |
| Exploit ScenarioDerived | An attacker with network access to an exposed Apache Camel endpoint sends crafted, malformed input that Camel fails to validate properly, causing the application to disclose information or partially alter its expected behavior. Given the AV:N/AC:L/PR:N vector, this requires no authentication and no user interaction and is low in complexity, though no public proof-of-concept has been published to date. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 06, 2026
Improper input validation in Apache Camel (versions through 4.14.7, 4.15.0-4.18.2, and 4.19.0-4.20.0) allows remote attackers to trigger information disclosure and limited integrity/availability effects against exposed Camel integration endpoints. The CVSS 3.1 base score is 7.3 (High) with a fully remote, unauthenticated vector, and the Apache-issued advisory tags the flaw as Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege vector warrants prompt patching.
Earlier versions of this analysis (2)
Improper input validation in Apache Camel, the widely-used open-source Java integration framework, allows remote attackers to trigger limited information disclosure and partial integrity/availability impact against affected instances (versions through 4.14.7, 4.15.0-4.18.2, and 4.19.0-4.20.0). The flaw is reported and confirmed by the Apache Software Foundation, is network-reachable without authentication or user interaction per the CVSS vector, and carries a CVSS 3.1 score of 7.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper input validation in Apache Camel enables information disclosure, affecting the widely-deployed Java integration framework across releases through 4.14.7, 4.15.0 to 4.18.2, and 4.19.0 to 4.20.0. Attackers supplying crafted input to a Camel-based integration route can potentially expose data that should not be accessible, consistent with the vendor's 'Information Disclosure' tag. No public exploit identified at time of analysis, and no CVSS score was published, so severity must be inferred from the limited vendor advisory.
RemediationAI
Vendor-released patch: upgrade to Apache Camel 4.14.8 (for the line through 4.14.7), 4.18.3 (for the 4.15.0-4.18.2 line), or 4.21.0 (for the 4.19.0-4.20.0 line), matching the fixed release to your current branch as recommended in the vendor advisory at https://camel.apache.org/security/CVE-2026-46588.html. Because the advisory does not document a supported configuration-only workaround, the upgrade is the primary and reliable fix. As interim compensating controls until you can patch, restrict network exposure of Camel endpoints by placing them behind authenticated gateways or firewall rules so untrusted clients cannot reach the vulnerable routes, and disable or tightly scope any Camel components/routes that accept externally-supplied input you do not strictly need - with the trade-off that restricting endpoint reachability may disrupt legitimate integrations that rely on those routes, so validate against your integration inventory first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Camel is a widely deployed Java-based enterprise integration framework that implements Enterprise Integration Patterns to route and transform messages across hundreds of connector components (HTTP, JMS, file, cloud services, etc.). The root cause is CWE-20 (Improper Input Validation): Camel does not adequately validate untrusted input before processing it, which per the vendor's Information Disclosure tag can lead to exposure of data that should not be accessible. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_camel, spanning multiple release trains (the 4.14.x maintenance line, the 4.15-4.18 line, and the 4.19-4.20 line). Because Camel is embedded inside larger integration and middleware deployments rather than run standalone, the exposed attack surface depends heavily on which components and routes an integration exposes to the network.
Know when Apache Camel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Remote unauthenticated low-complexity input to a network endpoint (AV:N/AC:L/PR:N/UI:N); vendor tags Information Disclosure with only partial CIA impact, so C/I/A all Low and scope unchanged.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Improper Input Validation vulnerability in Apache Camel.
This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0.
Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.
Blast Radius
ecosystem impact- 4 maven packages depend on org.apache.camel:camel-couchdb (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 4.0.0.
Executive ViewAI
Apache Camel integration endpoints (versions 4.14.7 and below, 4.15.0-4.18.2, and 4.19.0-4.20.0) are vulnerable to remote, unauthenticated information disclosure with limited integrity and availability impact. No vendor-released patch is currently available, leaving organizations using exposed Camel deployments at immediate risk of data exposure. Urgent asset inventory and network isolation are required.
Network isolation via firewall or WAF to restrict Camel endpoint access to authorized sources only; enhanced input filtering at integration layer where feasible; comprehensive logging and alerting on endpoint access patterns to detect exploitation attempts. Apply vendor patch immediately upon release by Apache.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Apache Camel
View allRemote code execution in Apache Camel's camel-coap component (versions 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0)
Unsafe Java deserialization in Apache Camel's camel-infinispan component allows arbitrary code execution when the ProtoS
Unauthenticated remote code execution affects the camel-hazelcast component of Apache Camel 4.0.0 through 4.18.4 and 4.1
Header-injection in the Apache Camel camel-atmosphere-websocket producer lets an external sender hijack WebSocket messag
Header-filter bypass in the Apache Camel Undertow component (4.11.0-4.14.8, 4.15.0-4.18.3, and 4.19.0-4.21.x) lets remot
Remote code execution in Apache Camel 3.18.0-4.14.5 and 4.15.0-4.18.1 stems from CXF and Knative HeaderFilterStrategy im
Message header injection in Apache Camel's camel-mail component (3.0.0 before 4.14.6 and 4.15.0 before 4.18.1) lets an a
Remote code execution via unsafe Java deserialization affects the camel-pqc component of Apache Camel 4.18.0-4.18.2 and
Unsafe Java deserialization in Apache Camel's camel-consul component (ConsulRegistry / ConsulRegistryUtils.deserialize)
Unauthenticated deserialization of attacker-controlled messages in Apache Camel's camel-jgroups consumer can lead to rem
Expression language injection in the Apache Camel dynamic-router-control endpoint allows a party who can place a message
Deserialization of untrusted data in the Apache Camel Spring Redis component (camel-spring-redis) allows an authenticate
Exploit-DB