{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/camel-spring-boot-4.22.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.5,"id":"CVE-2026-85260"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["camel-mllp (4.0.0 - 4.18.4, 4.19.0 - 4.22.0)","Camel Spring Boot (4.22.0)","Camel Quarkus (4.15.0)"],"_cs_severities":["low"],"_cs_tags":["apache","information-disclosure","camel","hl7","phi","cve-2026-85260"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel contains an information disclosure vulnerability (CVE-2026-85260) within the \u003ccode\u003ecamel-mllp\u003c/code\u003e component. The \u003ccode\u003elogPhi\u003c/code\u003e configuration option, which controls whether HL7 payload data is written to application logs, defaulted to \u003ccode\u003etrue\u003c/code\u003e in versions prior to the patch. This resulted in clinical PHI (Protected Health Information) being written to log files in plain text out of the box. Additionally, two internal code paths in the \u003ccode\u003ecamel-mllp\u003c/code\u003e component were found to log payload content regardless of the \u003ccode\u003elogPhi\u003c/code\u003e setting. This exposure allows unauthorized entities with access to log aggregation, storage, or monitoring systems to view sensitive medical data. The issue affects Camel versions 4.0.0 through 4.18.4, and 4.19.0 through 4.22.0. The vulnerability is mitigated by upgrading to version 4.18.5, 4.22.1, or 4.23.0, which changes the default \u003ccode\u003elogPhi\u003c/code\u003e value to \u003ccode\u003efalse\u003c/code\u003e and suppresses PHI logging in previously ignored code paths.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation or accidental exposure leads to the storage of plain-text PHI in log management systems (e.g., ELK, Splunk). If these logs are not strictly protected, this constitutes a violation of HIPAA or similar healthcare data privacy regulations. The number of potentially impacted systems includes any healthcare integration environment utilizing the \u003ccode\u003ecamel-mllp\u003c/code\u003e component for HL7 message processing.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Camel dependencies to version 4.18.5, 4.22.1, or 4.23.0 to ensure the \u003ccode\u003elogPhi\u003c/code\u003e option defaults to \u003ccode\u003efalse\u003c/code\u003e and PHI is suppressed.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not feasible, explicitly set \u003ccode\u003elogPhi=false\u003c/code\u003e in the MLLP component configuration; note that this does not remediate the two identified code paths that continue to log data until the patch is applied.\u003c/li\u003e\n\u003cli\u003eReview existing log management policies and access controls for all environments running \u003ccode\u003ecamel-mllp\u003c/code\u003e to identify and restrict unauthorized access to application log files containing potential HL7/PHI data.\u003c/li\u003e\n\u003cli\u003eImplement log scrubbing or redaction patterns in log aggregation pipelines (e.g., Logstash filters or SIEM ingest pipelines) to identify and mask HL7 PID segments or other sensitive markers if logs cannot be immediately cleared.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T10:32:40Z","date_published":"2026-10-20T10:32:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-camel-mllp-phi-exposure/","summary":"CVE-2026-85260 is an information disclosure vulnerability in the Apache Camel MLLP component where sensitive HL7 clinical messages are written to application logs by default, exposing protected health information.","title":"Apache Camel: Information disclosure of PHI via MLLP log files (CVE-2026-85260)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-camel-mllp-phi-exposure/"}],"language":"en","title":"CraftedSignal Threat Feed - Camel Spring Boot (4.22.0)","version":"https://jsonfeed.org/version/1.1"}