Apache Camel EUVD-2026-25816

The Camel deployment must run a route that consumes from a coap:// endpoint AND forwards the resulting Exchange to a header-sensitive producer - camel-exec for full OS command execution, or camel-sql/camel-bean/camel-file/camel-freemarker/camel-velocity for lesser header-driven abuse. No authentication is required (PR:N confirmed by CVSS vector) because CoAP has no built-in auth and DTLS is optional and disabled by default; exploitation needs only a single unauthenticated UDP datagram to the CoAP port (default 5683) with attacker-chosen URI query parameters that become Camel* headers. Limiting factors: the vulnerability is inert unless such a coap→sensitive-producer route is configured (this is the primary constraint narrowing real-world exposure and is reflected in the low EPSS), the CoAP port must be network-reachable to the attacker, and enabling DTLS would add an authentication barrier. This is a specific-configuration RCE, not a default-configuration one - most Camel installs do not use camel-coap.

The signals are strongly aligned toward high technical severity but mixed on real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) reflects unauthenticated network exploitation with total impact, and SSVC concurs on Technical Impact: total and Automatable: yes. However, SSVC Exploitation is 'none' (no observed active exploitation) and the vulnerability is NOT in CISA KEV, so this is not confirmed actively exploited despite the perfect CVSS. EPSS is only 0.55% (68th percentile), which is low for a CVSS-10 RCE and suggests the threat is not yet widespread - consistent with the fact that exploitation requires a fairly specific deployment (a CoAP consumer route forwarding to a header-sensitive producer), not merely that Camel is installed. Publicly available exploit code (github.com/dinosn/CVE-2026-33453) raises the practical risk and lowers the barrier for opportunistic scanning. Net: treat as a high-priority patch for anyone actually running camel-coap routes, but the low EPSS and 'none' exploitation status indicate the installed base of exploitable configurations is narrow rather than internet-ubiquitous. Note the data conflict flagged below: version 4.19.0 appears in both the affected list and the recommended-upgrade list.

An attacker locates an internet- or network-reachable Camel instance consuming from coap:// whose route forwards to camel-exec, then sends a single crafted CoAP UDP datagram to port 5683 with URI query parameters named CamelExecCommandExecutable and CamelExecCommandArgs. These injected headers override the configured command, causing arbitrary OS commands to run under the Camel process privileges, with the command output returned directly in the CoAP response for an interactive shell-like channel. A public proof-of-concept exists (github.com/dinosn/CVE-2026-33453), and the low attack complexity (AC:L) plus lack of authentication or user interaction make exploitation trivial where the vulnerable route exists.