Apache Camel CVE-2026-56139

The vulnerable application must be using the camel-undertow HTTP server consumer specifically - deployments using camel-http, camel-jetty, camel-servlet, or camel-platform-http are not affected. The attacker must be able to send HTTP requests to the endpoint and trigger a route-internal processing exception, which is achievable by sending malformed request bodies, invalid parameters, missing required headers, or any input that causes a route failure; no authentication is required (PR:N per CVSS assessment). The secondary bypass condition - where muteException=true is silently ignored - applies specifically to Rest DSL routes backed by camel-undertow on all affected versions, regardless of explicit operator configuration, making those consumers fully exposed even when administrators believe they have applied the configuration workaround. Exploitation is bounded to information disclosure; the vulnerability provides no mechanism for code execution, data modification, or denial of service through this vector alone.

Real-world risk is moderate and principally a reconnaissance enabler rather than a direct data-exfiltration or execution primitive. The attack vector is fully remote and requires no authentication or privileges (consistent with an estimated AV:N/AC:L/PR:N/UI:N vector), making the vulnerability reachable by any client with network access to an exposed undertow endpoint. However, the confidentiality impact is partial: stack traces reveal internal class names, dependency versions, filesystem paths, internal hostnames and IP addresses, database identifiers, and - critically - any credentials or tokens embedded in exception messages by application code. These signals materially lower the cost of follow-on attacks. The severity label of 'moderate' from the Apache project is consistent with an estimated CVSS 3.1 base score around 5.3, anchored entirely on C:L with no integrity or availability impact. No CVSS vector was assigned by NVD, no EPSS probability is available, and the CVE does not appear in the CISA KEV catalog - indicating no confirmed active exploitation at time of analysis. The Rest DSL bypass is the more operationally dangerous facet: operators who explicitly set muteException=true believing they had mitigated the issue on Rest DSL routes remained fully exposed, creating a false-mitigation condition that may have persisted undetected in production environments. EPSS data is absent and POC status is unknown, so exploitation prevalence cannot be quantified.

An unauthenticated attacker sends a deliberately malformed HTTP POST to a camel-undertow endpoint - for example, supplying an invalid JSON body or an unexpected content-type that causes a deserialization failure in the Camel route. The server responds with HTTP 500 and a text/plain body containing the complete Java stack trace, including embedded database connection strings, internal service hostnames, and the application's dependency versions. The attacker parses this output to identify exploitable internal services, outdated libraries with known CVEs, or plaintext credentials, then pivots to a targeted follow-on attack against those systems.