CVE-2026-85316

CVE-2026-85316 — camel-platform-http: unintended proxy mode from a path prefix Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-platform-http decided whether an endpoint ran in proxy mode by testing whether its configured path started with the string proxy, rath...

CVE-2026-84176

CVE-2026-84176 — camel-platform-http-vertx: CORS credential exposure reflected origin + credentials Runnable proof-of-concept reproducer for the Apache Camel vulnerability where VertxPlatformHttpServerSupport. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check —...

CVE-2026-85254

CVE-2026-85254 — camel-platform-http: request-header echo suppression bypass header-name case Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the guard that stops a request header being reflected into the response compared header names case-sensitively , while HTTP...

CVE-2026-40022

camel-platform-http-main Authentication Bypass on Non-Root Context Paths CVE-2026-40022 This project demonstrates an authentication bypass in Apache Camel's camel-platform-http-main component the embedded HTTP / management server of the Camel main runtime, tracked as CVE-2026-40022. When...

CVE-2026-85254

A flaw was found in Apache Camel's Platform HTTP component. The mechanism designed to prevent request headers from being reflected into HTTP responses improperly compares header names using case-sensitive checks. A remote attacker can exploit this behavior by varying header name casing or sending...

Exploit for CVE-2026-85316

CVE-2026-85316 — camel-platform-http: unintended proxy mode fr...

Apache Camel 4.22.0 Platform HTTP Proxy Mode

Apache Camel version 4.22.0 camel-platform-http contains an unintended proxy-mode issue where endpoint paths beginning with proxy are treated as catch-all forwarding proxies. https://packetstorm.news/download/236741...

Exploit for CVE-2026-85254

CVE-2026-85254 — camel-platform-http: request-header echo supp...

io.camelbee:camelbee-standalone-core (>=3.2.1, <=4.1.0), io.camelbee:camelbee-standalone-starter (>=3.2.1, <=4.1.0) +20 more potentially affected by CVE-2026-85254 via org.apache.camel:camel-platform-http-main (>=4.19.0, <=4.22.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.19.0, =3.2.1, =3.2.1, =1.5.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.20.0, =4.22.0 and more Source cves: CVE-2026-85254 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429367...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.0, <=1.4.1) +18 more potentially affected by CVE-2026-85254 via org.apache.camel:camel-platform-http-main (>=4.0.0, <=4.18.4)

org.apache.camel:camel-platform-http-main MAVEN version =4.0.0, =0.3.0, =1.0, =1.0, =4.7.0, =4.11.0, =4.0.0, =4.0.0, =4.18.0, =4.12.0, =4.7.0, =4.4.0, =4.8.0, =4.17.0, =4.14.0, =4.18.0, =4.18.4 and more Source cves: CVE-2026-85254 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429367...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the enhanceHeaderFilterStrategyToSkipHttpRequestHeaders function in the Platform HTTP component. An attacker can cause caller-supplied values in common request headers that the filter is meant t...

Insufficient Granularity of Access Control

Overview Affected versions of this package are vulnerable to Insufficient Granularity of Access Control via the isHttpProxy function in the Platform HTTP component. When a deployment exposes a route whose configured path begins with proxy such as proxyStats, the endpoint acts as a catch-all...

ai.wanaku:wanaku-routing-yaml-route-service (>=0.0.1, <=0.0.3), ai.wanaku:wanaku-tool-service-yaml-route (>=0.0.4, <=0.0.7) +81 more potentially affected by CVE-2026-85316 via org.apache.camel:camel-platform-http (>=4.0.0, <=4.18.4)

org.apache.camel:camel-platform-http MAVEN version =4.0.0, =0.0.1, =0.0.4, =1.1.0, =1.1.0, =2.0.1, =4.0.0, =2.0.1, =0.3.0, =1.0, =1.0, =0.7.1, =0.7.1, =0.7.1, =3.2.0, =3.15.3 and more Source cves: CVE-2026-85316 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429411...

com.codbex.atlas:codbex-atlas-application (>=2.110.0, <=14.56.0), com.codbex.iapetus:codbex-iapetus-application (>=2.74.0, <=2.76.0) +73 more potentially affected by CVE-2026-85316 via org.apache.camel:camel-platform-http (>=4.19.0, <=4.22.0)

org.apache.camel:camel-platform-http MAVEN version =4.19.0, =2.110.0, =2.74.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =1.5.0, =3.38.0, =3.38.0, =3.38.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-85316 Source advisory:...

io.camelbee:camelbee-quarkus-core (>=3.2.1, <=4.1.0), io.camelbee:camelbee-quarkus-security (>=3.2.1, <=4.1.0) +58 more potentially affected by CVE-2026-84176 via org.apache.camel:camel-platform-http-vertx (>=4.19.0, <=4.22.0)

org.apache.camel:camel-platform-http-vertx MAVEN version =4.19.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =1.5.0, =3.38.0, =3.38.0, =3.38.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-84176 Source advisory: SNYK:JAVA-O...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the createCorsHandler method in the Platform HTTP Vertx component. When CORS is enabled and camel.server.cors.origins is unset, an attacker can make a page on any origin send...

ai.wanaku:wanaku-routing-yaml-route-service (>=0.0.1, <=0.0.3), ai.wanaku:wanaku-tool-service-yaml-route (>=0.0.4, <=0.0.7) +65 more potentially affected by CVE-2026-84176 via org.apache.camel:camel-platform-http-vertx (>=4.0.0, <=4.18.4)

org.apache.camel:camel-platform-http-vertx MAVEN version =4.0.0, =0.0.1, =0.0.4, =2.0.1, =4.0.0, =2.0.1, =0.3.0, =1.0, =1.0, =0.7.1, =0.7.1, =0.7.1, =3.2.0, =3.2.0, =4.7.0, =3.4.0, =3.14.0 and more Source cves: CVE-2026-84176 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429957...

CVE-2026-85316

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...

CVE-2026-85254

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compared header names case sensitively, whi...

com.codbex.atlas:codbex-atlas-application (>=2.110.0, <=14.56.0), com.codbex.iapetus:codbex-iapetus-application (>=2.74.0, <=2.76.0) +73 more potentially affected by CVE-2026-85316 via org.apache.camel:camel-platform-http (>=4.19.0, <=4.22.0)

org.apache.camel:camel-platform-http MAVEN version =4.19.0, =2.110.0, =2.74.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =1.5.0, =3.38.0, =3.38.0, =3.38.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-85316 Source advisory: MEND:CVE-2026-85316...