[NEW] [high] Apache Camel: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities in Apache Camel can be exploited to execute arbitrary program code, bypass security measures, perform server-side request forgery, and disclose confidential information.

Who is affected

Deployments of Apache Camel are affected by these vulnerabilities.

Urgency

Remediation is high priority due to the severity of the vulnerabilities and potential for exploitation.

Action

Update to the latest version of Apache Camel to address these vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-08-14

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2203

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Moderate exploitation riskCVE-2026-400472.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 83% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-408590.89% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 57% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-438650.98% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 60% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-438660.65% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-464530.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-464540.83% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 55% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-464550.69% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-464560.79% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 54% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-464570.66% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-465840.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• mediumGHSA-hjg2-f45w-c566: Apache Camel-Undertow: The muteException consumer option defaulted to false, so a process…ghsa
• mediumGHSA-64gv-6cq2-45jr: Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP …ghsa
• criticalGHSA-qvc3-6q9x-95pj: Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication …ghsa
• highGHSA-rcvm-6r79-cf4r: Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocke…ghsa
• mediumGHSA-42q5-xw42-xf9g: Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a proce…ghsa
• mediumGHSA-463m-2hr2-q2j7: Apache Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Cam…ghsa
• mediumGHSA-mm84-qvjh-hcj7: Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constant…ghsa
• criticalGHSA-hcm8-x79p-wx2w: Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (S…ghsa
• mediumGHSA-583r-f84w-33g7: Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name…ghsa
• mediumGHSA-gcc7-c8mp-34qx: Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP hea…ghsa
• highGHSA-pw9q-pq7c-rfqw: Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-header…ghsa
• criticalGHSA-w2v8-8q6c-3rhr: Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStr…ghsa

Recent advisories for Apache Camel

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• high[UPDATE] [hoch] Apache Camel K: Mehrere Schwachstellencert-bund · 2026-09-10
• highCVE-2026-80354: Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authoriza…nvd · 2026-09-10
• criticalCVE-2026-80352: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A Y…nvd · 2026-09-10
• criticalCVE-2026-80351: Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnera…nvd · 2026-09-10
• medium[NEW] [medium] Red Hat Build of Apache Camel for Quarkus (sshd-core, libthrift, org.hl7.fhir.utilities): Multi…cert-bund · 2026-08-31
• medium[NEW] [medium] Apache Camel: Multiple Vulnerabilitiescert-bund · 2026-08-25

More from CERT-Bund (BSI) Security Advisories

• medium[UPDATE] [mittel] vim: Mehrere Schwachstellen2026-09-10
• medium[UPDATE] [mittel] ffmpeg: Mehrere Schwachstellen ermöglichen Codeausführung und DoS2026-09-10
• medium[UPDATE] [mittel] Unbound: Mehrere Schwachstellen2026-09-10
• high[UPDATE] [hoch] ffmpeg: Mehrere Schwachstellen2026-09-10
• high[UPDATE] [hoch] Internet Systems Consortium BIND: Mehrere Schwachstellen2026-09-10