Apache Camel PQC CVE-2026-85300

Requires that the deployment use the Apache Camel PQC component's FileBasedKeyLifecycleManager to write generated key material to disk, AND that the host's process umask permits group or world read (e.g. the common 022), leaving the unencrypted private key readable. Exploitation also requires the attacker to already hold a separate local account on the same host. Limiting factors: it is local-only (no remote or network path), it is non-default on hardened hosts where the key directory is placed on a path only the service account can traverse or where a restrictive umask is set, affected versions are 4.12.0-4.18.4 and 4.19.0-4.22.0, and keys written by fixed versions (4.18.5/4.22.1/4.23.0) are created owner-only. Note keys already written under the vulnerable versions remain exposed even after upgrade and must be rotated.

This is a genuinely low-priority issue despite the 5.5 (MEDIUM) CVSS base score, and the vendor itself assesses it as low. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is internally consistent with the description: the adversary is a local party with a low-privileged account, not the remote sender that Camel's threat model treats as the primary attacker, so the network-facing risk is effectively nil. Confidentiality impact is rated High because full private-key disclosure is total, but there is no integrity or availability impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied; exploitation status is therefore 'no public exploit identified at time of analysis.' There is no signal conflict to flag - every source points the same way: a locally-scoped information-disclosure flaw whose real-world risk is confined to multi-tenant or shared hosts with a permissive umask. The dangerous part is the consequence, not the likelihood: anyone who does read the key defeats every signature and key exchange that key backs. One input data defect: a 'Microsoft' vendor tag is attached to what is purely an Apache Software Foundation project.

On a shared host where Apache Camel runs the PQC component and the process umask is the common 022, a separate local unprivileged user simply reads the group/world-readable private key file that Camel wrote to its key directory. With the private key in hand, that user can forge signatures and decrypt or impersonate the key exchanges the Camel deployment performs. No public exploit is required - this is ordinary file reading, and no POC or active exploitation is reported.