Apache Camel EUVD-2026-104201

Requires an operator to have explicitly set enableCORS=true on a Jetty-based Camel HTTP endpoint (a non-default opt-in); affected Camel versions 4.0.0-4.18.4 and 4.19.0-4.22.0. With that option, Jetty's CrossOriginFilter defaults reflect any request origin and set Access-Control-Allow-Credentials=true. Exploitation is further limited by: (1) UI:R - a victim browser must visit an attacker-controlled page; (2) the victim must already hold credentials (cookies/session) for the target endpoint for credentialed reads to yield anything; (3) impact only matters if the endpoint returns sensitive data. Deployments that left CORS disabled, or that explicitly named allowedOrigins and controlled allowCredentials, are not exposed.

This is a moderate, config-dependent information-disclosure issue, not an urgent priority. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects network reach and no authentication, but the UI:R requirement and the limited confidentiality-only impact keep real risk low. No EPSS score, CISA KEV listing, or public POC was provided in the input, so by the precision rules this is 'no public exploit identified at time of analysis' - the signals are consistent in pointing to low real-world risk rather than conflicting. A key nuance the raw CVSS hides: exploitation only matters when an operator has explicitly set enableCORS=true on a Jetty endpoint, which is a non-default opt-in, and the real-world impact depends entirely on whether that endpoint serves credentialed, sensitive responses. The CVSS vector marks PR:N (unauthenticated attacker) which is accurate for the attacking web page, but the victim must be a user who is already authenticated/credentialed to the Camel endpoint - a limiting factor not captured by the base metrics. Treat as a hardening/patch-on-schedule item rather than an emergency.

An operator enables enableCORS on a Jetty endpoint, which silently installs Jetty's CrossOriginFilter stock defaults (reflect any origin + allow credentials). An attacker lures a user who holds a valid session/cookie for that endpoint to a malicious web page, which issues a credentialed cross-origin fetch; the browser attaches the user's credentials, the endpoint reflects the attacker origin and permits credentials, and the attacker's script reads the response. No public exploit code was identified in the provided data, and success requires the victim's interaction (UI:R).