CVE-2026-84176

CVE-2026-84176 — camel-platform-http-vertx: CORS credential exposure reflected origin + credentials Runnable proof-of-concept reproducer for the Apache Camel vulnerability where VertxPlatformHttpServerSupport. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check —...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the createCorsHandler method in the Platform HTTP Vertx component. When CORS is enabled and camel.server.cors.origins is unset, an attacker can make a page on any origin send...

io.camelbee:camelbee-quarkus-core (>=3.2.1, <=4.1.0), io.camelbee:camelbee-quarkus-security (>=3.2.1, <=4.1.0) +58 more potentially affected by CVE-2026-84176 via org.apache.camel:camel-platform-http-vertx (>=4.19.0, <=4.22.0)

org.apache.camel:camel-platform-http-vertx MAVEN version =4.19.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =1.5.0, =3.38.0, =3.38.0, =3.38.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-84176 Source advisory: SNYK:JAVA-O...

ai.wanaku:wanaku-routing-yaml-route-service (>=0.0.1, <=0.0.3), ai.wanaku:wanaku-tool-service-yaml-route (>=0.0.4, <=0.0.7) +65 more potentially affected by CVE-2026-84176 via org.apache.camel:camel-platform-http-vertx (>=4.0.0, <=4.18.4)

org.apache.camel:camel-platform-http-vertx MAVEN version =4.0.0, =0.0.1, =0.0.4, =2.0.1, =4.0.0, =2.0.1, =0.3.0, =1.0, =1.0, =0.7.1, =0.7.1, =0.7.1, =3.2.0, =3.2.0, =4.7.0, =3.4.0, =3.14.0 and more Source cves: CVE-2026-84176 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429957...

CVE-2026-84176 Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

io.camelbee:camelbee-quarkus-core (>=2.0.5, <=3.1.2), io.camelbee:camelbee-quarkus-security (>=2.0.5, <=3.1.2) +51 more potentially affected by CVE-2026-84176 via org.apache.camel:camel-platform-http-vertx (>=4.15.0, <=4.18.4)

org.apache.camel:camel-platform-http-vertx MAVEN version =4.15.0, =2.0.5, =2.0.5, =0.3.0, =1.0, =1.0, =0.7.1, =0.7.1, =0.7.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.33.3 and more Source cves: CVE-2026-84176 Source advisory: MEND:CVE-2026-84176https://vulners.com/me...

io.camelbee:camelbee-quarkus-core (>=3.2.1, <=4.1.0), io.camelbee:camelbee-quarkus-security (>=3.2.1, <=4.1.0) +58 more potentially affected by CVE-2026-84176 via org.apache.camel:camel-platform-http-vertx (>=4.19.0, <=4.22.0)

org.apache.camel:camel-platform-http-vertx MAVEN version =4.19.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =1.5.0, =3.38.0, =3.38.0, =3.38.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.39.0 and more Source cves: CVE-2026-84176 Source advisory: MEND:CVE-20...

CVE-2026-84176

The Apache Camel camel-platform-http-vertx component is vulnerable to a Permissive Cross-domain Policy with Untrusted Domains (CWE-942). The createCorsHandler() function incorrectly sets Access-Control-Allow-Credentials: true outside the origin check. When camel.server.cors.origins is unset, the ...

CVE-2026-84176 Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

CVE-2026-84176 Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

Exploit for CVE-2026-84176

CVE-2026-84176 — camel-platform-http-vertx: CORS credential ex...

Apache Camel configuration error vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a configuration error vulnerability. This vulnerability stems from the createCorsHandler method in the Platform HTTP Vertx component, which sets Access-Control-Allow-Credentials to true beyond source checks...