CVE-2026-84180

CVE-2026-84180 — camel-knative: HTTP consumer information disclosure exception written back to the caller Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the Knative HTTP consumer , when an exchange failed on the consumer side, wrote the resulting exception back to t...

CVE-2026-84180

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed on the consumer side, the Knative HTTP consumer wrote the...

CVE-2026-84180 Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed on the consumer side, the Knative HTTP consumer wrote the...

CVE-2026-84180 Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed on the consumer side, the Knative HTTP consumer wrote the...

CVE-2026-84180

The camel-knative component in Apache Camel (versions 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1) is vulnerable to information disclosure via unmuted consumer exceptions. When a consumer-side exchange fails, the Knative HTTP consumer writes the resulting exception—including class names, stack t...

CVE-2026-84180

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed on the consumer side, the Knative HTTP consumer wrote the...

Exploit for CVE-2026-84180

CVE-2026-84180 — camel-knative: HTTP consumer information disc...

Apache Camel 4.22.0 Knative HTTP Consumer Information Disclosure

Apache Camel version 4.22.0 camel-knative HTTP consumers disclose exception class names, messages, and stack traces to remote callers after a route failure. The supplied proof of concept demonstrates affected and fixed behavior. https://packetstorm.news/download/236341...

Apache Camel information leakage vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5, as well as from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises when the Knative HTTP consumer, during processing failures, returns exception messages containing class names, messages, and stack traces...

CVE-2026-48206

A flaw was found in the Apache Camel JIRA component. Due to improper input validation, non-Camel-prefixed Exchange header constants can bypass the HTTP header filter. This allows a remote attacker, potentially unauthenticated, to supply specific headers and override intended values. Consequently,...

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

Authorization Bypass

Apache Camel Lucene Component is vulnerable to Authorization Bypass. The vulnerability is due to the camel-lucene producer accepting the QUERY and RETURNLUCENEDOCS headers from inbound HTTP requests because HttpHeaderFilterStrategy only blocks the Camel-prefixed header namespace, where an attacke...

Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Kafka Component. The camel-kafka producer can override its configured target topic at runtime from the kafka.OVERRIDETOPIC Exchange header:...

CVE-2026-46585: Improper Input Validation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header LuceneConstants.HEADERQUERY whose value was the plain string QUERY and RETURNLUCENEDOCS for...