Apache Camel CVE-2026-85243

The target must run a route using the Apache Camel crypto PGP data format and decrypt incoming PGP messages via unmarshal(). The attacker must either control production of those messages or be able to rewrite them in transit, and must encode the message using the older OpenPGP symmetrically encrypted data packet (which carries no modification detection code) instead of the integrity-protected packet. Before the fix there was no decrypt-side option to require integrity, so any such deployment was exposed by default. Limiting factors: exploitation requires attacker influence over the message bytes (producer or MITM), yielding AC:H; impact is confined to integrity (undetected tampering/forgery of decrypted content) with no confidentiality or availability loss; and the issue only matters where Camel consumes externally-supplied PGP ciphertext.

This is a genuine but moderate-severity integrity flaw, not a drop-everything emergency. The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) correctly captures the shape of the problem: network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) because the attacker must either be the message producer or hold a man-in-the-middle position able to rewrite messages in transit, and the target deployment must consume PGP messages through Camel's crypto PGP unmarshal() path. Impact is integrity-only (I:H) with no confidentiality or availability effect (C:N/A:N) - the vulnerability lets an attacker defeat tamper-detection, not read secrets or crash the service. No EPSS score, CISA KEV listing, or public POC was provided, so there is no signal of active or imminent exploitation; the status is 'no public exploit identified at time of analysis.' One signal conflicts: the input carries an 'Information Disclosure' tag, but the CVSS vector sets C:N and the root cause (CWE-354, missing modification-detection-code validation enabling CFB malleability) is a tampering/integrity issue - the tag appears mislabeled and should not drive triage toward a confidentiality framing. Net: prioritize for patching in any deployment that decrypts externally-supplied PGP messages, but it ranks below network-exploitable code-execution or data-disclosure bugs.

An attacker who produces messages consumed by a Camel route, or who can rewrite messages in transit, sends a PGP message encoded with the legacy symmetrically encrypted data packet that carries no modification detection code. Camel's unmarshal() skips the integrity check for that packet type, and because OpenPGP's CFB mode is malleable, the attacker can modify the ciphertext so the route decrypts and accepts forged or tampered plaintext as if it were authentic. No public exploit identified at time of analysis.