Mittel28 / 100Konfidenz: Mittel

CVSS9.9EPSS2 %Über Netz erreichbarOhne Zutun des Nutzers

Prüfen Sie umgehend die bereitgestellten Herstellerinformationen und aktualisieren Sie Ihre Apache Camel Installationen auf die gepatchten Versionen.

▸Herleitung der Bewertung(2)

Wie der Wert zustande kommt

Hoechster CVSS-Basiswert 9.9+18
Ohne Anmeldung ueber das Netz ausnutzbar (CVE-2026-33454, CVSS-Vektor AV:N/PR:N)+10

Woraus sich die Konfidenz ergibt

Nur ein Herausgeber — keine Gegenlesung
Darunter eine behoerdliche Primaerquelle
Strukturierte CVE-Daten aus der NVD vorhanden

Die Konfidenz misst die Belegqualität, nicht die Schwere.

Einschränkungen

Schmale Datenlage: der Wert beruht auf wenigen Einzelsignalen.

Bewertung v1.2, deterministisch berechnet. Bedrohungswert und Konfidenz sind getrennte Größen.· 2026-10-20 11:05 UTCMethodik

[UPDATE] [hoch] Apache Camel: Mehrere Schwachstellen

CERT-Bund·20. Oktober 2026, 11:05

Originalartikel lesen bei CERT-Bund

Mehrere kritische Schwachstellen in Apache Camel ermöglichen Angreifern die Ausführung von beliebigem Code, Datenmanipulation oder Offenlegung vertraulicher Informationen. Betroffen sind diverse Apache Camel Versionen auf UNIX, Windows und anderen Plattformen, einschließlich Red Hat Enterprise Linux. Nutzer sollten umgehend die bereitgestellten Herstellerinformationen prüfen und ihre Systeme aktualisieren, um diese Risiken zu mindern.

SecBoard-Einordnung

Diese Schwachstellen ermöglichen Angreifern die vollständige Kompromittierung von Systemen durch Code-Ausführung, Datenmanipulation oder den Diebstahl sensibler Informationen, was zu erheblichen Betriebsunterbrechungen und Reputationsschäden führen kann.

Realistisch schlimmster Fall: Angreifer könnten beliebigen Code ausführen, um die Kontrolle über betroffene Systeme zu erlangen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen, was zu einem vollständigen Systemkompromiss führen kann.

Key Facts

CVE-2026-40453

CVSS: 9.9 · CRITICAL
EPSS: 2.1%
Über das Netz: ja
Anmeldung nötig: ja
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: 4.14.6
Zuweisende CNA: security@apache.org

CVE-2026-40860

CVSS: 9.8 · CRITICAL
EPSS: 1.7%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: 4.14.7
Zuweisende CNA: security@apache.org

CVE-2026-33454

CVSS: 9.4 · CRITICAL
EPSS: 1.5%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: 4.14.6
Zuweisende CNA: security@apache.org

CVE-2026-40858

CVSS: 8.8 · HIGH
EPSS: 1.3%
Über das Netz: ja
Anmeldung nötig: ja
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: 4.14.7
Zuweisende CNA: security@apache.org

CVE-2026-27172

CVSS: 8.8 · HIGH
EPSS: 1.2%
Über das Netz: ja
Anmeldung nötig: ja
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: 4.14.6
Zuweisende CNA: security@apache.org

CVE-2026-40473

CVSS: 8.8 · HIGH
EPSS: 1.2%
Über das Netz: ja
Anmeldung nötig: ja
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: 4.14.6
Zuweisende CNA: security@apache.org

CVE-2026-40022

CVSS: 8.2 · HIGH
EPSS: 0.9%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität
Patch: 4.14.6
Zuweisende CNA: security@apache.org

CVE-2026-40048

CVSS: 7.8 · HIGH
EPSS: 0.3%
Über das Netz: nein
Anmeldung nötig: ja
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: 4.18.2
Zuweisende CNA: security@apache.org

Betroffen

Diverse Apache Camel Versionen auf UNIX, Windows und anderen Plattformen, einschließlich Red Hat Enterprise Linux, sind betroffen.

Hersteller

Apache

Produkte

Camel

▸ CPE-Rohbezeichner anzeigen (2)

cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:*

Prüfen

▸Überprüfen Sie alle Apache Camel Installationen auf die aktuell installierte Version.
▸Stellen Sie sicher, dass alle Apache Camel Instanzen auf die vom Hersteller empfohlenen, gepatchten Versionen aktualisiert wurden.

▸ 1 weitere

▸Scannen Sie Ihre Systeme auf Anzeichen von unbefugtem Zugriff oder Datenmanipulation, falls Updates nicht zeitnah durchgeführt werden konnten.

Offene Punkte

▸ anzeigen

▸Spezifische CVE-IDs der Schwachstellen sind nicht angegeben.
▸Details zu den genauen betroffenen Versionen sind nicht spezifiziert, außer dass es sich um 'diverse' Versionen handelt.
▸Die Art der vertraulichen Informationen, die offengelegt werden könnten, ist nicht spezifiziert.

Red-Team-Relevanz

Was heißt das für dein nächstes Assessment?

▸ Einordnung anzeigen

Initial Access möglich?Unklar
Privilege Escalation relevant?Unklar
Exploit öffentlich verfügbar?Möglich
Detection / Logging prüfbar?Ja
Für Purple-Team-Szenario geeignet?Unklar

Kundenfragen

Haben wir Windows extern erreichbar?

MITRE ATT&CK(3)

Techniken aus allen Quellen zusammengeführt — nach Stärke des Belegs sortiert.

T1041Exfiltration Over C2 Channelzugeordnet

„Offenlegung vertraulicher Informationen“

T1059Command and Scripting Interpreterzugeordnet

„Angreifern die Ausführung von beliebigem Code“

T1490Inhibit System Recoveryzugeordnet

„Datenmanipulation“

Mehrere Herkünfte bei derselben Technik heißt: mehrere unabhängige Wege führen dorthin.

Quellen & Belege· 1 Quelle

CERT-BundPrimärbelegPUBLICZuverlässigkeit Adiese Meldung

Behoerdliche Veroeffentlichung mit Amtspflicht zur Richtigkeit, frei zugaenglich.

[UPDATE] [hoch] Apache Camel: Mehrere Schwachstellen

Nur eine Quelle — der Sachverhalt ist an keiner zweiten Stelle gegengelesen.

Verknüpfte Intelligence

Dieselben Entitäten an anderer Stelle auf SecBoard.

CVE-Profile

CVE-2026-40453 CVE-2026-40860 CVE-2026-33454 CVE-2026-40858 CVE-2026-27172 CVE-2026-40473 CVE-2026-40022 CVE-2026-40048

Themen

hoch

Vollständigen Artikel lesen bei CERT-Bund

Erwähnte CVEs (8)

CVE-2026-40453CRITICAL(9.9)

EPSS 2.1%

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS (or equivalent) producer access to the broker consumed by a Camel route can inject case-variant Camel internal headers, which are then resolved by downstream components such as camel-exec and camel-file using their canonical casing. This enables remote code execution and arbitrary file write on routes that forward JMS messages to header-driven components. This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

Details NVD

CVE-2026-40860CRITICAL(9.8)

EPSS 1.7%

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the classpath. The same handling was reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint) and through camel-amqp (whose AMQPJmsBinding extends JmsBinding), and by other JMS-family components built on JmsComponent such as camel-activemq and camel-activemq6. This issue affects Apache Camel: from 3.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

Details NVD

CVE-2026-33454CRITICAL(9.4)

EPSS 1.5%

The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' direction via setInFilterStartsWith. As a result, when a Camel application consumes mail through camel-mail (for example via from(\"imap://...\") or from(\"pop3://...\")) the inbound filter check is skipped and Camel-prefixed MIME headers are mapped unfiltered into the Exchange. An attacker who can deliver an email to a mailbox monitored by such a consumer can inject Camel-specific headers that, for some Camel components downstream of the mail consumer (such as camel-bean, camel-exec, or camel-sql), can alter the behaviour of the route. This is the same pattern that was previously addressed in camel-undertow (CVE-2025-30177) and the broader incoming-header filter (CVE-2025-27636 and CVE-2025-29891). This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1. Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.1. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6.

Details NVD

CVE-2026-40858HIGH(8.8)

EPSS 1.3%

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2. The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23322 refers to the various commits that resolved the issue, and have more details. This issue follows the same class of vulnerability previously addressed in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747.

Details NVD

CVE-2026-27172HIGH(8.8)

EPSS 1.2%

The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs. This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1. Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.

Details NVD

CVE-2026-40473HIGH(8.8)

EPSS 1.2%

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput (for example via getBody(ObjectInput.class) or @Body ObjectInput), an attacker sending a crafted serialized Java object over the network to the MINA consumer port can trigger arbitrary code execution in the context of the application during readObject(). This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.

Details NVD

CVE-2026-40022HIGH(8.2)

EPSS 0.9%

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at _path_* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact configured context path, not its subpaths. Unauthenticated requests to subpaths such as /api/_route_ or /admin/observe/info therefore reach protected business routes and management endpoints without being challenged for credentials. The /observe/info endpoint can disclose runtime metadata such as the user, working directory, home directory, process ID, JVM and operating system information. This issue affects Apache Camel: from 4.14.1 before 4.14.6, from 4.18.0 before 4.18.2. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, they are suggested to upgrade to 4.14.6. If users are on the 4.18.x LTS releases stream, they are suggested to upgrade to 4.18.2.

Details NVD

CVE-2026-40048HIGH(7.8)

EPSS 0.3%

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2. Users are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.

Details NVD