Apache Camel EUVD-2026-41826

Exploitation requires that the affected Camel route use the camel-hazelcast component with a Hazelcast instance built from Camel's own default configuration - i.e., no user-supplied HazelcastInstance, hazelcastConfigUri, or referenced Config bean. Any hazelcast consumer (hazelcast-topic, -queue, -seda, -map, -multimap, -replicatedmap, -list, -set) or the HazelcastAggregationRepository/HazelcastIdempotentRepository triggers the exposure by default, with no opt-in endpoint setting needed. The decisive limiting factor is network position: the attacker must be able to join or otherwise reach the Hazelcast cluster protocol, which is why CVSS rates AC:H despite PR:N/UI:N. Clusters that enforce Hazelcast authentication and TLS, or are network-segmented from untrusted hosts, sharply reduce reachability; conversely, a user-provided Hazelcast Config or HazelcastInstance is not affected at all.

Signals are mixed, which argues for prompt-but-not-panic patching. The CVSS base score is 8.1 (High) with AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H: network reachable, no authentication, no user interaction, but access complexity is High because the attacker must first reach or join the Hazelcast cluster - the real gate. EPSS is low (0.49%, 39th percentile) and the vulnerability is not in CISA KEV, with no public exploit identified at time of analysis, so there is no evidence of active or automated exploitation. No SSVC decision record is provided in the input. The dominant risk driver is deployment posture: clusters exposed on untrusted networks without authentication/TLS are genuinely at RCE risk (deserialization gadget chains are well understood), whereas clusters properly segmented and authenticated substantially raise the AC:H barrier. Net: a real priority for internet- or broad-LAN-exposed Camel/Hazelcast deployments, lower urgency where cluster membership is already tightly controlled.

An attacker who can reach the Hazelcast cluster port (through a flat internal network, misconfigured firewall, or by joining an unauthenticated cluster) crafts a malicious serialized Java gadget-chain object and publishes it onto the cluster. When any Camel node receives the object, Hazelcast deserializes it via ObjectInputStream.readObject with no class filter, triggering arbitrary code execution on every node. No public exploit is identified at time of analysis, and the AC:H rating reflects that the attacker must first gain cluster reachability.