What is the CVSS score of CVE-2026-46588?

CVE-2026-46588 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-46588?

Apache Camel integration endpoints (versions 4.14.7 and below, 4.15.0-4.18.2, and 4.19.0-4.20.0) are vulnerable to remote, unauthenticated information disclosure with limited integrity and…. A patch is available.

How to fix or mitigate CVE-2026-46588?

Within 24 hours: Identify all Apache Camel deployments, confirm affected versions (4.14.7 and below, 4.15.0-4.18.2, 4.19.0-4.20.0), and map network exposure of integration endpoints. Within 7 days: Implement network segmentation restricting Camel endpoint access to trusted sources only and enable enhanced endpoint logging for exploit detection. Within 30 days: Monitor Apache Camel security advisories for patch release; upgrade immediately to versions 4.14.8+, 4.18.3+, or 4.20.1+ upon availability.

Apache Camel CVE-2026-46588

EUVD-2026-41866 HIGH

Improper Input Validation (CWE-20)

2026-07-06 apache

GHSA-5g68-f6xg-vf2r

Information Disclosure Apache Apache Camel

7.3

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Remote unauthenticated low-complexity input to a network endpoint (AV:N/AC:L/PR:N/UI:N); vendor tags Information Disclosure with only partial CIA impact, so C/I/A all Low and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 19:38 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 19:37 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 19:22 NVD

7.3 (HIGH)

Analysis Generated

Jul 06, 2026 - 10:58 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 maven packages depend on org.apache.camel:camel-couchdb (3 direct, 6 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

Improper Input Validation vulnerability in Apache Camel.

This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0.

Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

AnalysisAI

Improper input validation in Apache Camel (versions through 4.14.7, 4.15.0-4.18.2, and 4.19.0-4.20.0) allows remote attackers to trigger information disclosure and limited integrity/availability effects against exposed Camel integration endpoints. The CVSS 3.1 base score is 7.3 (High) with a fully remote, unauthenticated vector, and the Apache-issued advisory tags the flaw as Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege vector warrants prompt patching.

Technical ContextAI

Apache Camel is a widely deployed Java-based enterprise integration framework that implements Enterprise Integration Patterns to route and transform messages across hundreds of connector components (HTTP, JMS, file, cloud services, etc.). The root cause is CWE-20 (Improper Input Validation): Camel does not adequately validate untrusted input before processing it, which per the vendor's Information Disclosure tag can lead to exposure of data that should not be accessible. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_camel, spanning multiple release trains (the 4.14.x maintenance line, the 4.15-4.18 line, and the 4.19-4.20 line). Because Camel is embedded inside larger integration and middleware deployments rather than run standalone, the exposed attack surface depends heavily on which components and routes an integration exposes to the network.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.14.8 (for the line through 4.14.7), 4.18.3 (for the 4.15.0-4.18.2 line), or 4.21.0 (for the 4.19.0-4.20.0 line), matching the fixed release to your current branch as recommended in the vendor advisory at https://camel.apache.org/security/CVE-2026-46588.html. Because the advisory does not document a supported configuration-only workaround, the upgrade is the primary and reliable fix. As interim compensating controls until you can patch, restrict network exposure of Camel endpoints by placing them behind authenticated gateways or firewall rules so untrusted clients cannot reach the vulnerable routes, and disable or tightly scope any Camel components/routes that accept externally-supplied input you do not strictly need - with the trade-off that restricting endpoint reachability may disrupt legitimate integrations that rely on those routes, so validate against your integration inventory first.