This issue is significant because it allows remote, unauthenticated attackers to probe the internal structure of the deployment. By sending crafted CloudEvents that intentionally trigger failures, an attacker can extract sensitive metadata including internal hostnames, filesystem structures, package names, and potentially embedded connection strings or configuration data. This vulnerability affects multiple versions of Camel (4.0.0 through 4.18.4, and 4.19.0 through 4.22.0). The fix introduces a muteException option, which defaults to true, ensuring that error status codes are returned without leaking exception details.

Impact

Successful exploitation results in the leakage of sensitive internal application telemetry and environmental configuration. This data can be leveraged to map internal network segments, identify vulnerable downstream services, or harvest credentials/connection strings if these are included in exception messages, facilitating subsequent, more targeted attacks against the organization's infrastructure.

Recommendation

Prioritize the upgrade of affected Apache Camel deployments to the patched versions.

• Upgrade Apache Camel to 4.18.5, 4.22.1, or 4.23.0 to resolve CVE-2026-84180.
• For Camel Quarkus users, ensure the project is updated to Quarkus 3.40.0 or later, which incorporates the fixed Camel 4.22.1 library.
• If patching is not immediately feasible, implement an onException handler within all consumer routes that explicitly catches potential failures and masks the response body before it is transmitted to the caller.
• Enable the muteException setting within the camel-knative configuration to prevent stack traces from being written to HTTP response bodies.