Cross-Exchange Data Disclosure in Apache Camel Thrift Component

Apache Camel’s camel-thrift component is vulnerable to a cross-exchange data disclosure flaw identified as CVE-2026-85245. The vulnerability resides in ThriftDataFormat.unmarshal, which deserializes incoming data into a shared defaultInstance rather than creating a fresh object per exchange. Because this instance is process-wide, fields absent from a subsequent Thrift payload retain values from previous messages. In multi-tenant or shared-route environments, this results in data leakage where one user or tenant may inadvertently read sensitive data belonging to another user. This issue affects Apache Camel versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0. The vulnerability is mitigated in versions 4.18.5, 4.22.1, and 4.23.0, where the implementation ensures a deep copy of the defaultInstance is created for every exchange.

Impact

Successful exploitation leads to unauthorized access to sensitive data across different sessions or tenants sharing the same Camel route. This impacts multi-tenant applications using Apache Camel for Thrift-based data processing, potentially exposing PII, credentials, or other private payload content that persists in the shared object instance across concurrent or sequential exchanges.

Recommendation

1. Upgrade Apache Camel deployments to versions 4.18.5, 4.22.1, or 4.23.0 to incorporate the fix for CVE-2026-85245.
2. If patching is not immediately feasible, modify application code to manually copy the unmarshalled body into a new instance immediately after the data format operation and ensure no references to the returned shared object are retained.