{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/camel-http/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-85251"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["camel-http (4.0.0-4.18.4, 4.19.0-4.22.0)"],"_cs_severities":["high"],"_cs_tags":["camel-http","credential-disclosure","apache"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel's 'camel-http' component is vulnerable to a credential disclosure vulnerability (CVE-2026-85251), allowing sensitive authentication headers to be leaked during HTTP redirects. When the 'followRedirects' configuration is enabled, the component incorrectly re-attaches 'Authorization' headers - including OAuth2 bearer tokens or basic/digest credentials - to any host specified in a 'Location' redirect header.\u003c/p\u003e\n\u003cp\u003eThis vulnerability stems from the 'OAuth2ClientConfigurer' and 'DefaultAuthenticationHttpClientConfigurer' logic, which fails to scope credentials to the intended target authority. Consequently, a remote endpoint can force the client to disclose credentials by providing a 302 redirect to an attacker-controlled server. This flaw primarily affects Spring Boot implementations where 'camel-http' is utilized. The issue was disclosed and assigned a CVSS score of 7.5 (High). Users are advised to upgrade to the fixed versions (4.18.5, 4.22.1, or 4.23.0) or disable automatic redirection as a temporary mitigation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to the exposure of sensitive OAuth2 bearer tokens, basic authentication credentials, or digest authentication credentials to unauthorized third parties. This allows an attacker to collect valid credentials and subsequently impersonate the authenticated client to access protected resources, potentially leading to unauthorized data exfiltration or system compromise within the affected organization's internal infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize upgrading 'camel-http' to versions 4.18.5, 4.22.1, or 4.23.0 to include the scoping fixes for 'OAuth2ClientConfigurer' and 'DefaultAuthenticationHttpClientConfigurer'.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, modify application code to disable 'followRedirects' on any Camel route endpoints that carry credentials.\u003c/li\u003e\n\u003cli\u003eImplement explicit redirect handling within Camel routes to ensure that redirect destinations are strictly controlled and validated against an allowlist of trusted hosts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T19:23:05Z","date_published":"2026-10-19T19:23:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camel-http-credential-disclosure/","summary":"CVE-2026-85251 allows for unauthorized credential exposure when the camel-http component follows HTTP redirects to attacker-controlled hosts.","title":"Credential Disclosure in Apache Camel camel-http Component","url":"https://feed.craftedsignal.io/briefs/2026-10-camel-http-credential-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Camel-Http","version":"https://jsonfeed.org/version/1.1"}