Apache Camel Vulnerabilities Allow Remote Code Execution, Authentication Bypass, and Data Theft

Apache Camel’s security advisories document critical and high-severity vulnerabilities that could allow for remote code execution, authentication bypass, credential exposure, and unauthorized file access.

These issues affect various integration components and Camel K, and their exploitability depends on the deployed components, route configurations, and an attacker’s access to messages or infrastructure.

The vulnerabilities involve unsafe Java deserialization, insufficient authentication enforcement, untrusted routing metadata, and Kubernetes configuration injection.

Each advisory describes a distinct exposure that requires a component-specific assessment; they do not represent a universal attack applicable to all Camel deployments.

Apache Camel Vulnerabilities

The following table outlines selected critical and high-severity advisories. The version ranges use inclusive lower bounds and exclusive upper bounds. Severity labels adhere to Apache’s security guidelines.

CVE	Severity	Component and impact	Affected versions
CVE-2026-80352	Critical	Camel K: YAML injection permits arbitrary Kubernetes objects	2.0.0–<2.9.3; 2.10.0–<2.10.2
CVE-2026-80351	Critical	Camel K: tenant repositories reach Maven execution inside operator pod	2.0.0–<2.9.3; 2.10.0–<2.10.2
CVE-2026-88900	High	JGroups: unsafe cluster-message deserialization enables RCE	4.0.0–<4.18.5; 4.19.0–<4.22.1
CVE-2026-78165	High	Spring Redis: unfiltered payload deserialization enables RCE	2.11.0–<4.18.5; 4.19.0–<4.22.1
CVE-2026-80312	High	OAuth: failed authentication does not stop processing	4.11.0–<4.18.5; 4.19.0–<4.22.1
CVE-2026-78164	High	HTTP producers: header overrides expose configuration and vault secrets	4.0.0–<4.18.5; 4.19.0–<4.22.1
CVE-2026-85251	High	HTTP: redirects disclose Authorization credentials	4.0.0–<4.18.5; 4.19.0–<4.22.1
CVE-2026-88901	High	Smooks: XML entities expose files and internal hosts	4.7.0–<4.18.5; 4.19.0–<4.22.1

Deserialization poses a direct code-execution risk when vulnerable consumers process attacker-controlled objects. For example, in CVE-2026-78165, the default `JdkSerializationRedisSerializer` processes Redis payloads without an `ObjectInputFilter`.

An attacker who can publish to the subscribed channel could achieve execution within the Camel process. Similarly, the JGroups vulnerability involves unsafe deserialization of cluster messages.

Failures in authentication also create vulnerabilities. CVE-2026-80312 allows OAuth processors to return control to a route rather than halt execution when authentication fails. As a result, requests that fail authentication may still progress through the application.

Data theft can occur without code execution. CVE-2026-78164 resolves property placeholders within message-supplied endpoint override headers, potentially exposing configuration values and vault secrets in outbound requests.

Additionally, CVE-2026-85251 reattaches Authorization headers to redirected destinations when `followRedirects` is enabled, which allows a remote server to determine which host receives the credentials.

Start remediation by identifying affected components and selecting patched releases for each product branch. Camel K requires its own upgrades; framework fixes do not substitute for those needed for the operator.

Teams should also review publisher permissions, redirect behavior, and untrusted message headers per the relevant advisory prerequisites. Prioritize routes where external input may reach vulnerable consumers, authentication processors, or outbound HTTP producers.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.