{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-85246/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2026-85246"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["camel-mina (4.0.0-4.18.4, 4.19.0-4.22.0)"],"_cs_severities":["medium"],"_cs_tags":["information-disclosure","apache-camel","cve-2026-85246"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel versions using the \u003ccode\u003ecamel-mina\u003c/code\u003e component are vulnerable to an information disclosure flaw (CVE-2026-85246). The vulnerability exists within the \u003ccode\u003eMinaConsumer\u003c/code\u003e class, which incorrectly writes \u003ccode\u003eexchange.getException()\u003c/code\u003e directly back to the remote peer when an exchange process fails. In scenarios using a textline codec, this exposes the exception class name and message; when using an object codec, it exposes the serialized exception and its cause chain.\u003c/p\u003e\n\u003cp\u003eAn attacker can provoke a route failure by sending crafted requests, effectively forcing the application to leak sensitive internal deployment data, including server paths, hostnames, and database configuration details. This issue affects versions from 4.0.0 before 4.18.5, and 4.19.0 before 4.22.1. A proof-of-concept reproducer is publicly available, highlighting the ease with which these details can be harvested over a socket.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a network service utilizing \u003ccode\u003ecamel-mina\u003c/code\u003e as a consumer for TCP or UDP traffic.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an input payload designed to force a processing failure within the Camel route.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a socket connection to the target service and transmits the crafted payload.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eMinaConsumer\u003c/code\u003e component attempts to process the exchange, triggering an internal \u003ccode\u003eIllegalStateException\u003c/code\u003e or other processing error.\u003c/li\u003e\n\u003cli\u003eThe application fails to handle the exception locally and instead writes the raw exception object or string representation back to the remote peer over the established socket.\u003c/li\u003e\n\u003cli\u003eThe attacker reads the server's response, extracting the leaked stack trace, configuration file paths, or host network details contained within the exception message.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the gathered internal intelligence to inform further targeted exploitation or lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the leakage of sensitive internal information. This allows unauthorized actors to map internal network infrastructure, identify sensitive local file paths (e.g., secret configuration locations), and gain insight into the backend deployment architecture, significantly reducing the effort required for subsequent attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to Apache Camel versions 4.18.5, 4.22.1, or 4.23.0 to resolve the vulnerability.\u003c/li\u003e\n\u003cli\u003eFor environments where immediate upgrades are not feasible, implement an \u003ccode\u003eonException\u003c/code\u003e handler in all Camel routes using Mina to intercept errors and ensure the response body is explicitly set, preventing the framework from writing the raw exception back to the client.\u003c/li\u003e\n\u003cli\u003eIf using \u003ccode\u003ecamel-mina\u003c/code\u003e configurations, verify the use of the new \u003ccode\u003emuteException\u003c/code\u003e consumer option, which defaults to \u003ccode\u003etrue\u003c/code\u003e in patched versions, and ensure it is not manually set to \u003ccode\u003efalse\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T12:17:09Z","date_published":"2026-10-19T12:17:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camel-mina-disclosure/","summary":"CVE-2026-85246 allows remote attackers to trigger route failures in Apache Camel Mina consumers, causing the disclosure of internal exception details, file paths, and hostnames over TCP/UDP sockets.","title":"Information Disclosure in Apache Camel camel-mina Component","url":"https://feed.craftedsignal.io/briefs/2026-10-camel-mina-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-85246","version":"https://jsonfeed.org/version/1.1"}