CVE-2026-85313

CVE-2026-85313 — camel-jetty: enableCORS grants credentialed any-origin access Runnable proof-of-concept reproducer for the Apache Camel vulnerability where setting enableCORS=true on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults — which reflect every origin and all...

Exploit for CVE-2026-85313

CVE-2026-85313 — camel-jetty: enableCORS grants credentialed...

io.hawt.examples:hawtio-example-springboot (>=4.0.0, <=4.2.0), io.hawt.examples:hawtio-example-springboot-log4j2 (>=4.1.0, <=4.2.0) +10 more potentially affected by CVE-2026-85313 via org.apache.camel:camel-jetty-common (>=4.0.0, <=4.18.4)

org.apache.camel:camel-jetty-common MAVEN version =4.0.0, =4.0.0, =4.1.0, =4.7.0, =4.0.0, =4.5.0, =4.5.0, =4.5.0, =4.0.0, =5.0-m1, =5.0-m1, =0.1.9, =0.1.6, =2025.1.0.0 Source cves: CVE-2026-85313 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429386...

org.apache.camel.springboot:camel-jetty-starter (>=4.19.0, <=4.22.0), org.apache.camel:camel-jetty (>=4.19.0, <=4.22.0) potentially affected by CVE-2026-85313 via org.apache.camel:camel-jetty-common (>=4.19.0, <=4.22.0)

org.apache.camel:camel-jetty-common MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85313 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429386...

Permissive Cross-domain Policy with Untrusted Domains

Overview org.apache.camel:camel-jetty-common is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the enableCORS configuration in the Jetty...

org.apache.camel.springboot:camel-jetty-starter (>=4.19.0, <=4.22.0), org.apache.camel:camel-jetty (>=4.19.0, <=4.22.0) potentially affected by CVE-2026-85313 via org.apache.camel:camel-jetty-common (>=4.19.0, <=4.22.0)

org.apache.camel:camel-jetty-common MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85313 Source advisory: MEND:CVE-2026-85313...

org.apache.camel.karaf:camel-jetty-common (>=4.18.1, <=4.18.4), org.apache.camel.springboot:camel-jetty-starter (>=4.15.0, <=4.18.4) +4 more potentially affected by CVE-2026-85313 via org.apache.camel:camel-jetty-common (>=4.15.0, <=4.18.4)

org.apache.camel:camel-jetty-common MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.15.0, =5.2-m1, =5.2-m1, =0.5.5, =0.5.6 Source cves: CVE-2026-85313 Source advisory: MEND:CVE-2026-85313...

org.apache.camel:camel-example-cxf (2.4.0), org.apache.camel:camel-jetty (2.4.0) +32 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.1.4.v20100610)

org.eclipse.jetty:jetty-xml MAVEN version 7.1.4.v20100610 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.apache.camel:camel-example-cxf 2.4.0 - org.apache.camel:camel-jetty 2.4.0 -...

org.apache.camel:camel-cometd (>=2.9.0-rc1, <=2.9.0), org.apache.camel:camel-example-cxf (>=2.9.0-rc1, <=2.9.0) +109 more potentially affected by CVE-2023-26049 via org.eclipse.jetty:jetty-server (7.5.3.v20111011)

org.eclipse.jetty:jetty-server MAVEN version 7.5.3.v20111011 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.camel:camel-cometd =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1,...

org.apache.camel:camel-example-cxf (2.3.0), org.apache.camel:camel-jetty (2.3.0) +6 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.0.1.v20091125)

org.eclipse.jetty:jetty-servlets MAVEN version 7.0.1.v20091125 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.apache.camel:camel-example-cxf 2.3.0 - org.apache.camel:camel-jetty 2.3.0 -...

org.apache.camel:camel-example-cxf (2.4.0), org.apache.camel:camel-jetty (2.4.0) +7 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.1.4.v20100610)

org.eclipse.jetty:jetty-servlets MAVEN version 7.1.4.v20100610 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.apache.camel:camel-example-cxf 2.4.0 - org.apache.camel:camel-jetty 2.4.0 -...

org.apache.camel:camel-example-cxf (2.8.0), org.apache.camel:camel-jetty (2.8.0) +8 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.4.2.v20110526)

org.eclipse.jetty:jetty-servlets MAVEN version 7.4.2.v20110526 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.apache.camel:camel-example-cxf 2.8.0 - org.apache.camel:camel-jetty 2.8.0 -...

org.apache.camel:camel-example-cxf (>=2.9.0-rc1, <=2.9.0), org.apache.camel:camel-jetty (>=2.9.0-rc1, <=2.9.0) +10 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.5.3.v20111011)

org.eclipse.jetty:jetty-servlets MAVEN version 7.5.3.v20111011 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.apache.camel:camel-example-cxf =2.9.0-rc1, =2.9.0-rc1, =1.1.5, =2.4.0.rc1 -...

com.cisco.oss.foundation:http-server-jetty-8 (>=0.0.0-6, <=1.0.2-2), net.osgiliath.framework:net.osgiliath.features.karaf-features-camel (>=0.1.2, <=0.1.5) +14 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (8.1.15.v20140411)

org.eclipse.jetty:jetty-servlets MAVEN version 8.1.15.v20140411 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - com.cisco.oss.foundation:http-server-jetty-8 =0.0.0-6, =0.1.2, =2.14.0, =2.14.0,...

org.apache.camel:camel-example-cxf (1.6.3) potentially affected by CVE-2015-5348 via org.apache.camel:camel-jetty (1.6.3)

org.apache.camel:camel-jetty MAVEN version 1.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-jetty and may be impacted: - org.apache.camel:camel-example-cxf 1.6.3 Source cves: CVE-2015-5348 Source advisory:...

org.apache.camel:camel-example-cxf (1.6.2) potentially affected by CVE-2015-5348 via org.apache.camel:camel-jetty (1.6.2)

org.apache.camel:camel-jetty MAVEN version 1.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-jetty and may be impacted: - org.apache.camel:camel-example-cxf 1.6.2 Source cves: CVE-2015-5348 Source advisory:...

GHSA-26V6-W6FW-RH94 Apache Camel can allow remote attackers to execute arbitrary commands

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

org.apache.camel:camel-jetty (1.2.0) potentially affected by CVE-2015-5348 via org.apache.camel:camel-http (1.2.0)

org.apache.camel:camel-http MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-http and may be impacted: - org.apache.camel:camel-jetty 1.2.0 Source cves: CVE-2015-5348 Source advisory: OSV:GHSA-26V6-W6FW-RH94...

org.apache.camel:camel-jetty (1.3.0), org.apache.servicemix.camel:org.apache.servicemix.camel.component (4.0-m1) potentially affected by CVE-2015-5348 via org.apache.camel:camel-http (1.3.0)

org.apache.camel:camel-http MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-http and may be impacted: - org.apache.camel:camel-jetty 1.3.0 - org.apache.servicemix.camel:org.apache.servicemix.camel.component...

org.apache.camel:camel-example-cxf (1.4.0), org.apache.camel:camel-jetty (1.4.0) potentially affected by CVE-2015-5348 via org.apache.camel:camel-http (1.4.0)

org.apache.camel:camel-http MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-http and may be impacted: - org.apache.camel:camel-example-cxf 1.4.0 - org.apache.camel:camel-jetty 1.4.0 Source cves: CVE-2015-5348...