CVE-2026-27172 Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

🗓️ 27 Apr 2026 09:59:45Reported by apacheType

Unsafe Java deserialization in camel-consul ConsulRegistry enables code execution via Consul KV data.

Reporter	Title	Published	Views	Family All 19
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Camel	6 Jul 202610:17	–	githubexploit
ATTACKERKB	CVE-2026-27172	27 Apr 202609:59	–	attackerkb
BDU FSTEC	The vulnerability of the ConsulRegistryUtils.deserialize method in the ConsulRegistry class of the Java framework Apache Camel allows a attacker to execute arbitrary code.	7 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-27172	26 Apr 202618:56	–	circl
CNNVD	Apache Camel 代码问题漏洞	27 Apr 202600:00	–	cnnvd
CVE	CVE-2026-27172	27 Apr 202609:59	–	cve
EUVD	EUVD-2026-25815	27 Apr 202609:59	–	euvd
Github Security Blog	Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data	27 Apr 202612:30	–	github
NCSC	Vulnerabilities handled in Apache Camel	29 Apr 202608:12	–	ncsc
NVD	CVE-2026-27172	27 Apr 202611:16	–	nvd

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel-consul",
    "product": "Apache Camel",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.14.6",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.18.1",
        "status": "affected",
        "version": "4.15.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
camel	www.camel.apache.org/security/CVE-2026-27172.html

27 Apr 2026 09:59Current

EPSS0.00667

CWE-502