Apache Camel CXF CVE-2026-85257

Requires the affected Camel route to expose a CXF SOAP consumer endpoint whose backing route can throw an exception NOT declared in the service contract (undeclared, non-@WebFault exceptions). The attacker must be able to supply input that provokes such a failure. The exception message is always echoed into the SOAP faultstring, but leakage of the full stack trace additionally requires the CXF endpoint to be configured to place the stack trace in the fault detail, so full-trace exposure is non-default. Limiting factors: only affects CXF SOAP consumers running vulnerable versions (4.0.0-4.18.4, 4.19.0-4.22.0); declared @WebFault exceptions are part of the published contract and are intentionally unaffected; impact is read-only information disclosure of deployment internals, not code execution or data modification; after patching, the muteException option defaults to true and suppresses undeclared-fault detail automatically.

This is a genuine but modest-severity information-disclosure issue (CWE-209), best treated as a low-to-moderate hygiene fix rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 Medium) correctly reflects a remotely reachable, low-complexity, unauthenticated flaw with only a limited confidentiality impact and no integrity or availability effect. No EPSS score, CISA KEV listing, or public exploit was provided in the intelligence set, so by the precision rules this is 'no public exploit identified at time of analysis'; there is no signal of active or widespread exploitation. The signals are internally consistent - a low-impact disclosure bug reported by the vendor (Apache) with a patch available - and none conflict. The practical risk is that an external SOAP caller who can trigger an undeclared exception learns internal class/package names and exception text, which aids reconnaissance for follow-on attacks but does not itself grant access. Full stack-trace leakage additionally depends on a non-default CXF configuration (fault detail enabled), which further lowers real-world exposure. Priority should be: patch during normal maintenance, prioritizing internet-facing Camel CXF SOAP consumers.

An attacker who can reach a Camel CXF SOAP endpoint sends a request crafted to make the backing route throw an exception the WSDL contract does not declare (e.g. malformed data or input that triggers a backend error). Camel copies the exception message into the SOAP faultstring returned to the caller, revealing internal class and package names and the exception text; if the endpoint is configured to include the stack trace in the fault detail, the full trace leaks too. No public exploit code was identified, and because AV:N/AC:L/PR:N/UI:N the attack is remote, unauthenticated, and low-complexity.