Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*

9 briefs RSS
high advisory

Credential Disclosure in Apache Camel camel-http Component

CVE-2026-85251 allows for unauthorized credential exposure when the camel-http component follows HTTP redirects to attacker-controlled hosts.

camel-http credential-disclosure apache
1t 1c
high advisory

Apache Camel XML External Entity Injection via camel-xpath

An XML External Entity (XXE) vulnerability in the Apache Camel camel-xpath component allows attackers to trigger local file disclosure or server-side request forgery when documentType is set to InputSource.

camel-xpath +2 xxe vulnerability apache
1t 1c
medium advisory

Information Disclosure in Apache Camel Knative HTTP Consumer

An information disclosure vulnerability (CVE-2026-84180) in the camel-knative HTTP consumer allows remote attackers to retrieve internal application details, stack traces, and configuration data via intentional route failures.

camel-knative +1 camel information-disclosure cloud-native cve-2026-84180
1t 1c
medium advisory

Integrity-Verification Downgrade Vulnerability in Apache Camel PGP

An integrity-verification downgrade in camel-crypto-pgp allows attackers to bypass modification detection by using legacy OpenPGP packets, potentially leading to the acceptance and decryption of malleable ciphertext.

camel-crypto-pgp vulnerability apache-camel cryptography
1t 1c
medium advisory

Cross-Exchange Data Disclosure in Apache Camel Thrift Component

A vulnerability in the camel-thrift component, CVE-2026-85245, allows cross-tenant data disclosure by reusing a shared object instance for unmarshalling Thrift payloads.

camel-thrift data-disclosure apache-camel cve-2026-85245
1c
medium advisory

Information Disclosure in Apache Camel camel-mina Component

CVE-2026-85246 allows remote attackers to trigger route failures in Apache Camel Mina consumers, causing the disclosure of internal exception details, file paths, and hostnames over TCP/UDP sockets.

camel-mina information-disclosure apache-camel cve-2026-85246
1t 1c
high advisory

Apache Camel Template Injection via HTTP Producer Headers

Vulnerabilities in Apache Camel HTTP producers allow unauthenticated users to trigger arbitrary property resolution and bean method invocation via manipulated CamelHttpUri or CamelRestHttpUri headers.

Apache Camel +3 apache camel remote-code-execution information-disclosure template-injection cloud xml-external-entity xxe +2
6t 1c
high advisory

Apache Camel FTP Component Path Traversal Vulnerability

Apache Camel's camel-ftp component contains a path traversal vulnerability (CVE-2026-79983) allowing unauthorized file operations outside the intended directory via malicious server-supplied file listings.

Camel +1 camel-ftp path-traversal cve-2026-79983 apache-camel
high advisory

Public Exploit for Apache Camel CVE-2026-49098 Improper Input Validation

A public exploit has been released for CVE-2026-49098, an improper input validation vulnerability in Apache Camel's 'camel-kafka' component, which allows an attacker to perform message-header injection by supplying 'kafka.OVERRIDE_TOPIC' in HTTP headers, enabling cross-topic message injection and integrity compromise of sensitive Kafka topics.

Apache Camel +2 apache-camel vulnerability kafka injection
1t 1c