Apache Camel EUVD-2026-104188

Exploitation requires a specific non-default misconfiguration AND a privileged network position. On the victim side, TLS must be turned on for the Knative HTTP client (camel.knative.client.ssl.enabled=true) while NO truststore or trust certificate is configured (camel.knative.client.ssl.truststore.path / trust.cert.path unset) - in affected versions this silently installs a trust-all manager. On the attacker side, the adversary must be able to intercept and terminate the TLS connection as a man-in-the-middle on the network path, which is the AC:H factor. Limiting factors: deployments that explicitly configure a truststore, that do not enable SSL, or that run on a trusted/segmented network path are not realistically exploitable; the vulnerable state is reached only by the SSL-on-without-truststore combination, so it is not universal across Camel installs.

This is a genuine but conditional man-in-the-middle exposure, not a drive-by critical. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N = 5.9, Medium) is internally consistent with the description: no authentication is needed by the attacker (PR:N), but AC:H correctly reflects that two independent conditions must coincide - the victim must have enabled SSL on the Knative HTTP client WITHOUT configuring a truststore, and the attacker must hold a privileged position on the network path to intercept the TLS session. No EPSS score, KEV listing, or public POC was provided in the input; the issue was self-reported by Apache with a coordinated patch, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The confidentiality-only impact (C:H, I:N, A:N) is appropriate because the flaw defeats peer authentication and lets an on-path attacker decrypt traffic; note, however, that a full MITM that can terminate the session could in principle also tamper with traffic, so a conservative reading might extend this to integrity - the vendor scored integrity as N and this analysis follows that, flagging it as a judgment call. The combination of signals points to a real-but-moderate priority: patch in normal maintenance windows, prioritizing any deployment that is known to run Knative TLS without an explicit truststore.

An Apache Camel deployment enables TLS on its Knative HTTP client but omits a truststore, so the client silently accepts any presented certificate. An attacker who can position themselves on the network path (e.g. a compromised node, ARP/DNS spoofing, or a rogue service in the cluster) presents their own certificate, transparently terminates the TLS connection, and reads or relays the plaintext Knative event traffic. No public exploit code is referenced, but the technique is standard MITM against an unauthenticated TLS peer and requires no authentication to the application.