Apache Camel EUVD-2026-104203

Requires a deployment running an affected Apache Camel version (4.0.0 before 4.18.5, or 4.19.0 before 4.22.1) that exposes a gRPC consumer endpoint reachable by the attacker, AND a route behind that consumer that throws an exception the attacker can provoke. Disclosure only occurs when the exception message itself contains sensitive content (paths, host names, connection detail), so impact varies by what the route's exceptions carry. Key limiting factors: the fix introduces a muteException consumer option defaulting to true that substitutes a generic status description, so patched/default-configured deployments are not exposed; only pre-patch versions, or post-patch deployments that explicitly set muteException=false, leak the message. An onException handler mapping failures to an explicit status also prevents the leak.

This is a genuine but low-severity information-disclosure issue (CVSS 5.3, CWE-209) rather than a high-priority emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N correctly reflects a network-reachable, unauthenticated, low-complexity flaw with only limited confidentiality impact and no integrity or availability effect - consistent with the description, which involves leaking an exception message, not code execution or data modification. No EPSS score was provided, the CVE is not in CISA KEV, and no POC was supplied, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of widespread or targeted exploitation. Signals are therefore consistent (all point to low operational risk) with no contradiction between the CVSS network vector and the description, which also describes a remote caller provoking a failure. The practical impact is bounded: the disclosed data is whatever the exception carries (class/package names, file paths, host names, connection details) - useful for reconnaissance but not directly compromising. Reported by Apache with a patch available, this is a routine-patch item that should be scheduled, not a drop-everything priority.

An external client sends a gRPC request that triggers a failure in the Camel route behind the gRPC consumer (for example by supplying input that causes a downstream exception). On vulnerable versions the route exception's message is copied into the gRPC status description and transmitted back to the caller, letting the attacker harvest internal details such as class/package names, file paths, host names, and connection strings for reconnaissance. No public exploit code is identified; the low attack complexity (AC:L) and lack of authentication (PR:N) make failures easy to provoke, but the payoff is limited to information leakage.