Camel-Quarkus-Platform-Http (< 3.40.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/camel-quarkus-platform-http--3.40.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 10:17:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Camel: Request forgery vulnerability in camel-platform-http (CVE-2026-85316)https://feed.craftedsignal.io/briefs/2026-10-camel-proxy-rce/Wed, 21 Oct 2026 10:17:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-camel-proxy-rce/An unintended proxy mode classification in Apache Camel via prefix matching allows unauthenticated request forgery, potentially exposing internal services to unauthorized access.CVE-2026-85316 is a request forgery vulnerability in the camel-platform-http component. The vulnerability is caused by an incorrect implementation of proxy mode identification, where the library evaluates if an endpoint is a proxy by checking if the configured path starts with the string "proxy" instead of requiring an exact match.

Endpoints with paths starting with "proxy" (e.g., "proxyStats", "proxy-health") are incorrectly forced into proxy mode. In this mode, the endpoint acts as a forwarding proxy that uses the client-provided "Host" header to determine its destination. This behavior exposes internal services or resources that the application server can reach.

Impact

Successful exploitation allows for request forgery, where an attacker can proxy requests through the vulnerable endpoint to reach internal network resources. The severity is mitigated by the need for the application to have existing routes with paths starting with "proxy" that were not intended to serve as proxies.

Recommendation

  • Upgrade camel-platform-http to version 4.18.5, 4.22.1, or 4.23.0.
  • Upgrade camel-quarkus-platform-http to version 3.40.0 or later.
  • If upgrading is not immediately possible, identify all platform-http endpoints with paths starting with "proxy" that are not intended to act as proxies and rename these paths to avoid the prefix conflict.
]]>lowadvisorycamel-platform-httprequest-forgeryssrfcve-2026-85316