{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/camel-thrift-4.0.0-4.18.4-4.19.0-4.22.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.9,"id":"CVE-2026-85245"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["camel-thrift (4.0.0-4.18.4, 4.19.0-4.22.0)"],"_cs_severities":["medium"],"_cs_tags":["data-disclosure","apache-camel","cve-2026-85245"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel’s \u003ccode\u003ecamel-thrift\u003c/code\u003e component is vulnerable to a cross-exchange data disclosure flaw identified as CVE-2026-85245. The vulnerability resides in \u003ccode\u003eThriftDataFormat.unmarshal\u003c/code\u003e, which deserializes incoming data into a shared \u003ccode\u003edefaultInstance\u003c/code\u003e rather than creating a fresh object per exchange. Because this instance is process-wide, fields absent from a subsequent Thrift payload retain values from previous messages. In multi-tenant or shared-route environments, this results in data leakage where one user or tenant may inadvertently read sensitive data belonging to another user. This issue affects Apache Camel versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0. The vulnerability is mitigated in versions 4.18.5, 4.22.1, and 4.23.0, where the implementation ensures a deep copy of the \u003ccode\u003edefaultInstance\u003c/code\u003e is created for every exchange.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to unauthorized access to sensitive data across different sessions or tenants sharing the same Camel route. This impacts multi-tenant applications using Apache Camel for Thrift-based data processing, potentially exposing PII, credentials, or other private payload content that persists in the shared object instance across concurrent or sequential exchanges.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Apache Camel deployments to versions 4.18.5, 4.22.1, or 4.23.0 to incorporate the fix for CVE-2026-85245.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, modify application code to manually copy the unmarshalled body into a new instance immediately after the data format operation and ensure no references to the returned shared object are retained.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T12:17:15Z","date_published":"2026-10-19T12:17:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camel-thrift-data-disclosure/","summary":"A vulnerability in the camel-thrift component, CVE-2026-85245, allows cross-tenant data disclosure by reusing a shared object instance for unmarshalling Thrift payloads.","title":"Cross-Exchange Data Disclosure in Apache Camel Thrift Component","url":"https://feed.craftedsignal.io/briefs/2026-10-camel-thrift-data-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Camel-Thrift (4.0.0-4.18.4, 4.19.0-4.22.0)","version":"https://jsonfeed.org/version/1.1"}