Apache Camel CVE-2026-85312

Exploitable only in deployments that run Camel sagas with a CamelSagaService that consults the Long-Running-Action header - in practice the camel-lra component backed by an external LRA coordinator - AND where a consumer accepts inbound messages from untrusted senders without stripping that header. Limiting factors: the InMemorySagaService and other services that do not advertise header support are unaffected; exploitation requires an in-flight saga whose identifier the attacker can supply/correlate (reflected in AC:H); no authentication is required (PR:N) but the attacker must have a path to inject messages into the saga-enabled route. The documented mitigation is removeHeaders("Long-Running-Action") at every untrusted consumer, or upgrading to 4.23.0/4.18.5/4.22.1.

This is a genuine but low-to-moderate priority issue, not a top-tier emergency. The vendor CVSS of 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) is internally consistent with the description: network-reachable because an external sender supplies the Long-Running-Action header on an inbound message (AV:N, PR:N), but high complexity (AC:H) because exploitation depends on a specific deployment (sagas running over an LRA coordinator) and on the attacker correlating with an in-flight saga identifier, with only low confidentiality and integrity impact and no availability impact. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - the GitHub pull requests contain fix code and regression tests, not weaponized exploit code. There is no SSVC decision data supplied. The signals do not conflict: a modest CVSS, absence of KEV/EPSS/POC, and a tightly bounded trigger condition all point to a low real-world exploitation likelihood, meaningful only to the narrow subset of Apache Camel deployments that run sagas over an LRA coordinator and accept messages from untrusted senders.

An attacker who can send messages into a Camel route that participates in LRA-backed sagas includes a crafted Long-Running-Action header on an inbound message; because the header lies outside the Camel namespace that consumer header filters strip, it is honored and the attacker's exchange is attached to a saga started by a different participant. The attacker can thereby join another party's long-running action or cause compensation to be associated with an action they never initiated. No public exploit code was identified; exploitation requires an active saga over an LRA coordinator and knowledge or guessing of its identifier, consistent with the high attack complexity (AC:H).