Apache Camel’s security advisories document critical and high-severity vulnerabilities that could allow for remote code execution, authentication bypass, credential exposure, and unauthorized file access.
These issues affect various integration components and Camel K, and their exploitability depends on the deployed components, route configurations, and an attacker’s access to messages or infrastructure.
The vulnerabilities involve unsafe Java deserialization, insufficient authentication enforcement, untrusted routing metadata, and Kubernetes configuration injection.
Each advisory describes a distinct exposure that requires a component-specific assessment; they do not represent a universal attack applicable to all Camel deployments.
Apache Camel Vulnerabilities
The following table outlines selected critical and high-severity advisories. The version ranges use inclusive lower bounds and exclusive upper bounds. Severity labels adhere to Apache’s security guidelines.
| CVE | Severity | Component and impact | Affected versions |
|---|---|---|---|
| CVE-2026-80352 | Critical | Camel K: YAML injection permits arbitrary Kubernetes objects | 2.0.0–<2.9.3; 2.10.0–<2.10.2 |
| CVE-2026-80351 | Critical | Camel K: tenant repositories reach Maven execution inside operator pod | 2.0.0–<2.9.3; 2.10.0–<2.10.2 |
| CVE-2026-88900 | High | JGroups: unsafe cluster-message deserialization enables RCE | 4.0.0–<4.18.5; 4.19.0–<4.22.1 |
| CVE-2026-78165 | High | Spring Redis: unfiltered payload deserialization enables RCE | 2.11.0–<4.18.5; 4.19.0–<4.22.1 |
| CVE-2026-80312 | High | OAuth: failed authentication does not stop processing | 4.11.0–<4.18.5; 4.19.0–<4.22.1 |
| CVE-2026-78164 | High | HTTP producers: header overrides expose configuration and vault secrets | 4.0.0–<4.18.5; 4.19.0–<4.22.1 |
| CVE-2026-85251 | High | HTTP: redirects disclose Authorization credentials | 4.0.0–<4.18.5; 4.19.0–<4.22.1 |
| CVE-2026-88901 | High | Smooks: XML entities expose files and internal hosts | 4.7.0–<4.18.5; 4.19.0–<4.22.1 |
Deserialization poses a direct code-execution risk when vulnerable consumers process attacker-controlled objects. For example, in CVE-2026-78165, the default `JdkSerializationRedisSerializer` processes Redis payloads without an `ObjectInputFilter`.
An attacker who can publish to the subscribed channel could achieve execution within the Camel process. Similarly, the JGroups vulnerability involves unsafe deserialization of cluster messages.
Failures in authentication also create vulnerabilities. CVE-2026-80312 allows OAuth processors to return control to a route rather than halt execution when authentication fails. As a result, requests that fail authentication may still progress through the application.
Data theft can occur without code execution. CVE-2026-78164 resolves property placeholders within message-supplied endpoint override headers, potentially exposing configuration values and vault secrets in outbound requests.
Additionally, CVE-2026-85251 reattaches Authorization headers to redirected destinations when `followRedirects` is enabled, which allows a remote server to determine which host receives the credentials.
Start remediation by identifying affected components and selecting patched releases for each product branch. Camel K requires its own upgrades; framework fixes do not substitute for those needed for the operator.
Teams should also review publisher permissions, redirect behavior, and untrusted message headers per the relevant advisory prerequisites. Prioritize routes where external input may reach vulnerable consumers, authentication processors, or outbound HTTP producers.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
