Credential Disclosure in Apache Camel camel-http Component

Apache Camel's 'camel-http' component is vulnerable to a credential disclosure vulnerability (CVE-2026-85251), allowing sensitive authentication headers to be leaked during HTTP redirects. When the 'followRedirects' configuration is enabled, the component incorrectly re-attaches 'Authorization' headers - including OAuth2 bearer tokens or basic/digest credentials - to any host specified in a 'Location' redirect header.

This vulnerability stems from the 'OAuth2ClientConfigurer' and 'DefaultAuthenticationHttpClientConfigurer' logic, which fails to scope credentials to the intended target authority. Consequently, a remote endpoint can force the client to disclose credentials by providing a 302 redirect to an attacker-controlled server. This flaw primarily affects Spring Boot implementations where 'camel-http' is utilized. The issue was disclosed and assigned a CVSS score of 7.5 (High). Users are advised to upgrade to the fixed versions (4.18.5, 4.22.1, or 4.23.0) or disable automatic redirection as a temporary mitigation.

Impact

Successful exploitation leads to the exposure of sensitive OAuth2 bearer tokens, basic authentication credentials, or digest authentication credentials to unauthorized third parties. This allows an attacker to collect valid credentials and subsequently impersonate the authenticated client to access protected resources, potentially leading to unauthorized data exfiltration or system compromise within the affected organization's internal infrastructure.

Recommendation

• Prioritize upgrading 'camel-http' to versions 4.18.5, 4.22.1, or 4.23.0 to include the scoping fixes for 'OAuth2ClientConfigurer' and 'DefaultAuthenticationHttpClientConfigurer'.
• If patching is not immediately feasible, modify application code to disable 'followRedirects' on any Camel route endpoints that carry credentials.
• Implement explicit redirect handling within Camel routes to ensure that redirect destinations are strictly controlled and validated against an allowlist of trusted hosts.