{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-85296/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.5,"id":"CVE-2026-85296"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["camel-as2 (4.0.0-4.18.4, 4.19.0-4.22.0)","camel-spring-boot (3.5.13)","camel-quarkus-as2"],"_cs_severities":["medium"],"_cs_tags":["camel-as2","cve-2026-85296","vulnerability","as2"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eCVE-2026-85296 is a vulnerability within the \u003ccode\u003ecamel-as2\u003c/code\u003e component of Apache Camel (versions 4.0.0 to 4.18.4 and 4.19.0 to 4.22.0) that permits cross-partner signing key confusion during the processing of AS2 (Applicability Statement 2) messages. The vulnerability stems from the \u003ccode\u003eResponseMDN\u003c/code\u003e class, which incorrectly stores per-request signing material in a shared instance field. In multi-partner AS2 deployments, where a single \u003ccode\u003eResponseMDN\u003c/code\u003e instance serves concurrent requests, the private key resolved for one trading partner can be overwritten or accessed by a subsequent or concurrent request from a different partner. Consequently, an AS2 Message Disposition Notification (MDN) may be signed using the private key of the incorrect trading partner. This vulnerability is triggered by legitimate concurrent AS2 traffic and does not require complex delivery mechanisms.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe target deploys a multi-partner AS2 interface using the affected \u003ccode\u003ecamel-as2\u003c/code\u003e component.\u003c/li\u003e\n\u003cli\u003eThe application registers a single shared \u003ccode\u003eResponseMDN\u003c/code\u003e instance on the \u003ccode\u003eHttpProcessor\u003c/code\u003e to handle incoming AS2 requests.\u003c/li\u003e\n\u003cli\u003ePartner A initiates an AS2 request, and the system resolves Partner A's signing material into the \u003ccode\u003eResponseMDN\u003c/code\u003e instance.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecamel-as2\u003c/code\u003e component writes this per-request private key into an instance field of the shared \u003ccode\u003eResponseMDN\u003c/code\u003e object.\u003c/li\u003e\n\u003cli\u003ePartner B initiates a concurrent or subsequent AS2 request before the previous operation concludes or cleans up.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eResponseMDN\u003c/code\u003e instance processes the request for Partner B, potentially reading the signing key stored in the instance field that still holds Partner A's material.\u003c/li\u003e\n\u003cli\u003eThe application generates an MDN for Partner B that is cryptographically signed using the private key belonging to Partner A.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the signing of MDN responses with the incorrect trading partner's private key. This compromise of cryptographic integrity impacts non-repudiation and authentication within AS2 communication, potentially allowing misrouting of signed receipts or business logic disruption between trading partners. The vulnerability affects multi-partner AS2 environments, including those utilizing Camel Spring Boot and Camel Quarkus implementations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to Apache Camel 4.18.5, 4.22.1, or 4.23.0 to resolve the state management flaw in \u003ccode\u003eResponseMDN\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not feasible, re-architect the Camel deployment to utilize a separate Camel context for each trading partner to ensure isolation of signing material.\u003c/li\u003e\n\u003cli\u003eVerify the fix by monitoring application logs for signing key resolution behavior; the fixed version resolves material into local variables rather than shared instance fields.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T11:33:10Z","date_published":"2026-10-20T11:33:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camel-as2-signing-confusion/","summary":"CVE-2026-85296 allows cross-partner signing key leakage in Apache Camel AS2 deployments due to improper state management of per-request keys in shared instance fields.","title":"Apache Camel: AS2 MDN signing key confusion (CVE-2026-85296)","url":"https://feed.craftedsignal.io/briefs/2026-10-camel-as2-signing-confusion/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-85296","version":"https://jsonfeed.org/version/1.1"}