{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/camel-knative-4.0.0-4.18.4-4.19.0-4.22.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2026-84180"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["camel-knative (4.0.0-4.18.4, 4.19.0-4.22.0)","camel-quarkus (prior to 3.40.0)"],"_cs_severities":["medium"],"_cs_tags":["camel","information-disclosure","cloud-native","cve-2026-84180"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel contains an information disclosure vulnerability in the \u003ccode\u003ecamel-knative\u003c/code\u003e component, tracked as CVE-2026-84180. When a Knative HTTP consumer route encounters an internal processing error, the application fails to handle the exception safely. Instead of suppressing the output, the component serializes the exception class name, the error message, and the full stack trace into the HTTP response body returned to the caller.\u003c/p\u003e\n\u003cp\u003eThis issue is significant because it allows remote, unauthenticated attackers to probe the internal structure of the deployment. By sending crafted CloudEvents that intentionally trigger failures, an attacker can extract sensitive metadata including internal hostnames, filesystem structures, package names, and potentially embedded connection strings or configuration data. This vulnerability affects multiple versions of Camel (4.0.0 through 4.18.4, and 4.19.0 through 4.22.0). The fix introduces a \u003ccode\u003emuteException\u003c/code\u003e option, which defaults to true, ensuring that error status codes are returned without leaking exception details.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the leakage of sensitive internal application telemetry and environmental configuration. This data can be leveraged to map internal network segments, identify vulnerable downstream services, or harvest credentials/connection strings if these are included in exception messages, facilitating subsequent, more targeted attacks against the organization's infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the upgrade of affected Apache Camel deployments to the patched versions.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Camel to 4.18.5, 4.22.1, or 4.23.0 to resolve CVE-2026-84180.\u003c/li\u003e\n\u003cli\u003eFor Camel Quarkus users, ensure the project is updated to Quarkus 3.40.0 or later, which incorporates the fixed Camel 4.22.1 library.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, implement an \u003ccode\u003eonException\u003c/code\u003e handler within all consumer routes that explicitly catches potential failures and masks the response body before it is transmitted to the caller.\u003c/li\u003e\n\u003cli\u003eEnable the \u003ccode\u003emuteException\u003c/code\u003e setting within the \u003ccode\u003ecamel-knative\u003c/code\u003e configuration to prevent stack traces from being written to HTTP response bodies.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T12:17:38Z","date_published":"2026-10-19T12:17:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camel-knative-info-disclosure/","summary":"An information disclosure vulnerability (CVE-2026-84180) in the camel-knative HTTP consumer allows remote attackers to retrieve internal application details, stack traces, and configuration data via intentional route failures.","title":"Information Disclosure in Apache Camel Knative HTTP Consumer","url":"https://feed.craftedsignal.io/briefs/2026-10-camel-knative-info-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Camel-Knative (4.0.0-4.18.4, 4.19.0-4.22.0)","version":"https://jsonfeed.org/version/1.1"}