Apache Camel MLLP CVE-2026-85260

Requires the camel-mllp component to be in active use carrying HL7 clinical messages (a healthcare-integration deployment) AND read access to the application logs where payloads are written. Exposure occurs by default because logPhi defaulted to true, and critically two code paths wrote payload content to the log regardless of the logPhi setting - so even a deployment that explicitly set logPhi=false remained exposed on those paths until upgrading. Limiting factors: this is not remotely triggerable as an active attack (AV:L) - the 'attacker' must already be able to read the logs; impact is confined to deployments using MLLP/HL7; and severity scales with how broadly logs are aggregated and accessed. Mitigation short of upgrade is setting logPhi=false plus restricting log access, with the caveat that two paths keep logging until the fix (4.18.5/4.22.1/4.23.0) is applied.

This is a genuine data-exposure defect but a low-urgency one in attacker terms. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/C:H/I:N/A:N) correctly frames it as a local, low-privilege confidentiality-only issue rather than a remotely weaponizable flaw: there is no code execution, no integrity or availability impact, and the 'attack' is really passive - PHI is written to ordinary application logs, and whoever can read those logs gains the data. No EPSS score, KEV listing, or public POC was provided, which is consistent with a logging/information-disclosure bug that has no exploit to write: exploitation status is 'no public exploit identified at time of analysis.' The real risk is driven by exposure and compliance (HL7 patient data landing in logs governed by general log retention/aggregation/access controls, not clinical-record controls), not by ease of remote attack. Two caveats to flag explicitly: (1) the CVSS C:H assumes the reader of the logs is not authorized for the PHI, so real impact depends entirely on who can access the logs - a well-segregated log store lowers it, a centralized SIEM/log-aggregation pipeline widens exposure considerably; (2) the defaulted-to-true behavior plus two paths that logged regardless of the setting mean many deployments were exposed out of the box, so the practical breadth is larger than the modest CVSS number suggests. Priority should be set by regulatory exposure (HIPAA/PHI handling), not by the 5.5 base score alone.

An Apache Camel deployment using the camel-mllp component to route HL7 clinical messages runs with default settings, so full HL7 payloads containing patient data are written to application logs; even operators who set logPhi=false remain exposed on two code paths that log payloads regardless. Anyone with read access to those logs - a log-aggregation platform, SIEM, backup, or a lower-privileged operator - can harvest protected health information. No public exploit is required, as this is passive information disclosure rather than an active attack.