CVE-2026-88900

CVE-2026-88900 — camel-jgroups: unsafe Java deserialization of cluster messages Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the jgroups consumer Java-deserialized cluster messages with no filter. JGroupsEndpoint.createExchangeMessage — called for every message th...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.26 Security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.26 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.26 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.26 Security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.26 (RHSA-2026:99099)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99099 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.26 (RHSA-2026:99098)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99098 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.26 Security update (Important) (RHSA-2026:99097)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99097 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...

Exploit for CVE-2026-88900

CVE-2026-88900 — camel-jgroups: unsafe Java deserialization of...

Apache Camel 4.22.0 JGroups Unsafe Java Deserialization

Apache Camel version 4.22.0 camel-jgroups contains an unsafe Java deserialization issue in cluster message processing. The proof of concept demonstrates attacker-controlled object deserialization using a benign marker class. https://packetstorm.news/download/236735...

CVE-2026-88900

A flaw was found in Apache Camel's camel-jgroups component. This vulnerability allows an unauthenticated attacker on an adjacent network to achieve arbitrary code execution on the target system. By default, the component joins cluster communication channels without authentication or encryption an...

org.apache.camel.quarkus:camel-quarkus-jgroups (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-jgroups-deployment (>=3.35.0, <=3.39.0) +1 more potentially affected by CVE-2026-88900 via org.apache.camel:camel-jgroups (>=4.19.0, <=4.22.0)

org.apache.camel:camel-jgroups MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-88900 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429457...

org.apache.camel.karaf:camel-jgroups (>=4.7.0, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-integration-test-jgroups (>=3.2.0, <=3.13.0) +4 more potentially affected by CVE-2026-88900 via org.apache.camel:camel-jgroups (>=4.0.0, <=4.18.4)

org.apache.camel:camel-jgroups MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.6.0, =4.0.0, =4.18.4 Source cves: CVE-2026-88900 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429457...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via JGroupsEndpoint.createExchangeMessage in the Camel-JGroups consumer. An attacker with network access to the JGroups cluster can send a crafted serialized ObjectMessage, which JGroups deserializes...

CVE-2026-88900

Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchangeMessage, which CamelJGroupsReceiver calls for every message the jgroups consumer receives...

EUVD-2026-104244

Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchangeMessage, which CamelJGroupsReceiver calls for every message the jgroups consumer receives...