EUVD-2026-41834
GHSA-857v-xvh8-7hjc
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jul 06, 2026
Remote code execution via unsafe Java deserialization affects the camel-pqc component of Apache Camel 4.18.0-4.18.2 and 4.19.0-4.20.x. The HashiCorp Vault and AWS Secrets Manager KeyLifecycleManager implementations (and a legacy-migration path in the file-based manager) read post-quantum key metadata back with a raw ObjectInputStream.readObject() lacking any ObjectInputFilter or allow-list, so a principal able to write to the key backend can plant a gadget object that executes during normal key-lifecycle operations. No public exploit has been identified at time of analysis and EPSS is low (0.19%), but SSVC rates technical impact as total; this is an incomplete-remediation follow-on to CVE-2026-40048.
Earlier versions of this analysis (4)
Untrusted Java deserialization in the Apache Camel camel-pqc component (4.18.0-4.18.2 and 4.19.0-4.20.x) lets a principal who can write to the operator-controlled key backend achieve code execution in the key-management application. The HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path of FileBasedKeyLifecycleManager read post-quantum KeyMetadata back with a raw ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list, so a poisoned serialized blob executes before the KeyMetadata cast is ever checked. This is an incomplete-fix follow-on to CVE-2026-40048; there is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not on CISA KEV, but SSVC rates technical impact as total.
Remote code execution risk in the Apache Camel camel-pqc component (4.18.0-4.18.2 and 4.19.0-4.20.x) allows a principal with write access to the post-quantum key backend to achieve arbitrary code execution in the key-management application's context. The HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and FileBasedKeyLifecycleManager deserialize stored KeyMetadata/KeyPair values via an unfiltered java.io.ObjectInputStream.readObject(), so a crafted gadget executes before the KeyMetadata cast. No public exploit is identified at time of analysis; EPSS is low (0.19%, 9th percentile) and SSVC exploitation is 'none', though technical impact is rated total. This is an incomplete-remediation follow-on to CVE-2026-40048.
Insecure Java deserialization in the Apache Camel PQC component (camel-pqc) allows a principal with write access to the key-metadata backend to achieve code execution in the key-management application, affecting Camel 4.18.0-4.18.2 and 4.19.0-4.20.x. The HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager, plus the legacy-migration path in FileBasedKeyLifecycleManager, call raw ObjectInputStream.readObject() on Base64-wrapped backend values with no ObjectInputFilter or class allow-list, so gadget side effects fire before the KeyMetadata cast. This is an incomplete-remediation follow-on to CVE-2026-40048; there is no public exploit identified at time of analysis and EPSS is low (0.19%).
Remote code execution via unsafe Java deserialization in Apache Camel's camel-pqc component (versions 4.18.0-4.18.3 and 4.19.0-4.21.0) is achievable by any principal who can write to the operator-controlled secret backend storing post-quantum key metadata. All three KeyLifecycleManager implementations-HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path of FileBasedKeyLifecycleManager-invoke java.io.ObjectInputStream.readObject() on attacker-controlled bytes without an ObjectInputFilter or class allowlist, allowing gadget-chain side effects to fire before any type check. This is a confirmed incomplete-remediation follow-on to CVE-2026-40048; no public exploit has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Apache Camel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires privileged write access to the operator-controlled Vault/Secrets Manager backend, so PR:H over the network (AV:N); successful deserialization yields full C/I/A compromise of the key-management app.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Apache Camel PQC component.
The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadata back from the configured secret backend by deserializing a Base64-wrapped value with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. The same unfiltered legacy-migration read also remained in FileBasedKeyLifecycleManager (for the stored KeyPair and KeyMetadata). A principal who can write to the operator-controlled backend that holds these values - the HashiCorp Vault KV path, or the AWS Secrets Manager secret (requiring a Vault token or secretsmanager:PutSecretValue) - could store a crafted serialized object that is deserialized during normal key-lifecycle operations, potentially leading to code execution in the context of the application that manages the keys. This is an incomplete-remediation follow-on to CVE-2026-40048 (CAMEL-23200), which changed FileBasedKeyLifecycleManager to store metadata as JSON / PKCS#8 / X.509 but did not add an ObjectInputFilter, did not cover the Vault and AWS sibling managers, and left FileBasedKeyLifecycleManager's own legacy-migration deserialization unfiltered. This issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0.
Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the key backend so that only the application's own identity can write the camel-pqc secrets (least-privilege HashiCorp Vault policies and secretsmanager:PutSecretValue IAM), and keep the PQC key material in a backend separate from any data that less-trusted principals can write.
Blast Radius
ecosystem impact- 3 maven packages depend on org.apache.camel:camel-pqc (2 direct, 1 indirect)
Ecosystem-wide dependent count for version 4.18.0.
Articles & Coverage 2
Executive ViewAI
Apache Camel's post-quantum cryptography key management component (versions 4.18.0-4.18.2, 4.19.0-4.20.x) contains a high-severity remote code execution vulnerability exploitable by actors with backend write access. This incomplete remediation for CVE-2026-40048 affects encryption key lifecycle operations across organizations using these versions. Immediate patching is required to prevent unauthorized code execution and downstream system compromise.
Within 24 hours: Inventory systems running Apache Camel 4.18.0-4.18.2 and 4.19.0-4.20.x; verify whether CVE-2026-40048 patches are deployed; assess key backend write-access controls. Within 7 days: Apply vendor-released patch to all affected systems and validate upgrade completion. Within 30 days: Audit backend access controls, review key lifecycle operation logs, and implement enhanced monitoring.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Apache Camel
View allRemote code execution in Apache Camel's camel-coap component (versions 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0)
Unsafe Java deserialization in Apache Camel's camel-infinispan component allows arbitrary code execution when the ProtoS
Unauthenticated remote code execution affects the camel-hazelcast component of Apache Camel 4.0.0 through 4.18.4 and 4.1
Header-injection in the Apache Camel camel-atmosphere-websocket producer lets an external sender hijack WebSocket messag
Header-filter bypass in the Apache Camel Undertow component (4.11.0-4.14.8, 4.15.0-4.18.3, and 4.19.0-4.21.x) lets remot
Remote code execution in Apache Camel 3.18.0-4.14.5 and 4.15.0-4.18.1 stems from CXF and Knative HeaderFilterStrategy im
Message header injection in Apache Camel's camel-mail component (3.0.0 before 4.14.6 and 4.15.0 before 4.18.1) lets an a
Unsafe Java deserialization in Apache Camel's camel-consul component (ConsulRegistry / ConsulRegistryUtils.deserialize)
Unauthenticated deserialization of attacker-controlled messages in Apache Camel's camel-jgroups consumer can lead to rem
Expression language injection in the Apache Camel dynamic-router-control endpoint allows a party who can place a message
Deserialization of untrusted data in the Apache Camel Spring Redis component (camel-spring-redis) allows an authenticate
Cypher injection in Apache Camel's camel-neo4j producer allows attackers who control JSON key names in the CamelNeo4jMat
Exploit-DB