EUVD-2026-104205

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...

EUVD-2026-104204

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...

CVE-2026-85315 Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status...

CVE-2026-85315

The Apache Camel gRPC component is vulnerable to information disclosure (CWE-209) because exception messages from failed routes are included in the gRPC status description. This description is transmitted to the calling client, potentially revealing sensitive internal details such as class and pa...

EUVD-2026-104203

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status...

CVE-2026-85314 Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)

Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format...

CVE-2026-85314

The Apache Camel Mail component is vulnerable to a Header Injection vulnerability due to improper input validation during the unmarshalling of MimeMultipart data. This issue is an incomplete fix for CVE-2026-46584 , where mail.smtp headers remain unfiltered and fall outside the blocked Camel name...

EUVD-2026-104202

Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format...

CVE-2026-85313 Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which acce...

CVE-2026-85313

The Apache Camel Jetty component is vulnerable to a Permissive Cross-domain Policy with Untrusted Domains (CWE-942) when the enableCORS option is used. The vulnerability arises because enableCORS installs Jetty's CrossOriginFilter with default settings that accept every origin and allow credentia...

EUVD-2026-104201

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which acce...

EUVD-2026-104200

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel...

CVE-2026-85300 Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

CVE-2026-85300

The Apache Camel PQC component is vulnerable to Incorrect Default Permissions (CWE-276) in versions 4.12.0 to 4.18.5 and 4.19.0 to 4.22.1. The root cause is that the component writes generated key material to disk using default process umask permissions instead of restricting access to the owner....

EUVD-2026-104199

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

CVE-2026-85301 Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim

Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim...

CVE-2026-85301

The Apache Camel Keycloak component contains an Improper Authentication vulnerability (CWE-287) in versions 4.15.0 before 4.18.5 and 4.19.0 before 4.22.1. The security processor incorrectly skipped issuer validation when an introspection response omitted the iss claim, instead of treating the abs...

EUVD-2026-104198

Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim...

EUVD-2026-104197

Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined ...

CVE-2026-85296 Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State

Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined ...