EN PT-BR
← Voltar ao feed
high

Apache Camel and Camel K flaws allow RCE via deserialization, OAuth authentication bypass and credential leakage

1 fonte(s) · 1 atualização(ões) · publicado 26/10/2026 08:30 · coletado há 6 dias

Apache's security advisories describe critical and high-severity vulnerabilities in Apache Camel integration components and Camel K. They could allow remote code execution, authentication bypass, credential exposure and unauthorized file access. Exploitability depends on the deployed components, route configuration and the attacker's access to messages or infrastructure, so these are not a universal attack on every Camel deployment. The article does not report active exploitation.

Entenda a falha

A vulnerabilidade

Apache published advisories for several Apache Camel and Camel K flaws. The most severe is CVE-2026-78165: the Redis component's default JdkSerializationRedisSerializer deserializes payloads without an ObjectInputFilter, so an attacker able to publish to the subscribed channel can get code execution in the Camel process. A separate JGroups issue involves unsafe deserialization of cluster messages. CVE-2026-80312 lets OAuth processors continue the route after failed authentication. CVE-2026-78164 exposes configuration values and vault secrets, and CVE-2026-85251 leaks Authorization headers to redirect targets. The articles give no affected or fixed versions here; they say to pick the patched release per branch.

Como funciona

For the Redis flaw, a message published on a channel the Camel route subscribes to reaches the consumer, which deserializes the Java object using the default serializer with no filter on allowed classes. Attacker-controlled objects are therefore processed inside the Camel process, which is where code can run. For OAuth, a request reaches the authentication processor; when authentication fails, the processor hands control back to the route instead of stopping it, so the request keeps going. For CVE-2026-78164, placeholders inside message-supplied endpoint override headers are resolved, so configuration values or vault secrets end up in outbound requests. For CVE-2026-85251, with followRedirects enabled, the Authorization header is re-sent to the redirected host chosen by the remote server.

Por que é vulnerável

The deserialization flaws come from trusting object data from messages or the cluster: the default Redis serializer applies no ObjectInputFilter to restrict what can be deserialized. The OAuth bypass is a logic error in flow control, since a failed authentication returns control to the route rather than halting execution. CVE-2026-78164 comes from resolving property placeholders in data that the message sender controls. CVE-2026-85251 comes from keeping credentials on redirects without checking the new destination. The articles do not explain why these went unnoticed or detail the fixes, beyond saying to upgrade to patched releases.

Onde está

The articles name the Camel Redis component's default JdkSerializationRedisSerializer, the JGroups component, the OAuth processors and the followRedirects setting, but no files, functions or commits.

Como foi descoberta

The articles do not say who found these flaws or how they were reported. They only state that they were disclosed through Apache Camel's security advisories, and that no active exploitation is reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 26/10/2026 09:16.

Detalhes técnicos

  • CVE-2026-78165: the default JdkSerializationRedisSerializer processes Redis payloads without an ObjectInputFilter. An attacker who can publish to the subscribed channel could achieve code execution within the Camel process.
  • A separate JGroups issue involves unsafe deserialization of cluster messages.
  • CVE-2026-80312: OAuth processors return control to the route instead of halting when authentication fails, so unauthenticated requests may still progress through the application.
  • CVE-2026-78164: property placeholders are resolved within message-supplied endpoint override headers, potentially exposing configuration values and vault secrets in outbound requests.
  • CVE-2026-85251: Authorization headers are reattached to redirected destinations when followRedirects is enabled, letting a remote server decide which host receives the credentials.
  • The advisories also cover untrusted routing metadata and Kubernetes configuration injection affecting Camel K.

Remediação

  • Identify the affected components and upgrade to the patched release for each product branch.
  • Camel K needs its own upgrades; framework fixes do not cover the operator.
  • Review publisher permissions, redirect behavior and untrusted message headers against each advisory's prerequisites.
  • Prioritize routes where external input can reach vulnerable consumers, authentication processors or outbound HTTP producers.

Linha do tempo

  1. gbhackers.com ↗ · pub. 26/10/2026 08:30 · coletado 26/10 09:00 primeiro registro

    Apache Camel and Camel K flaws allow RCE via deserialization, OAuth authentication bypass and credential leakage

    ler a análise desta fonte

    Apache's security advisories describe critical and high-severity vulnerabilities in Apache Camel integration components and Camel K. They could allow remote code execution, authentication bypass, credential exposure and unauthorized file access. Exploitability depends on the deployed components, route configuration and the attacker's access to messages or infrastructure, so these are not a universal attack on every Camel deployment. The article does not report active exploitation.

    Technical Details

    • CVE-2026-78165: the default JdkSerializationRedisSerializer processes Redis payloads without an ObjectInputFilter. An attacker who can publish to the subscribed channel could achieve code execution within the Camel process.
    • A separate JGroups issue involves unsafe deserialization of cluster messages.
    • CVE-2026-80312: OAuth processors return control to the route instead of halting when authentication fails, so unauthenticated requests may still progress through the application.
    • CVE-2026-78164: property placeholders are resolved within message-supplied endpoint override headers, potentially exposing configuration values and vault secrets in outbound requests.
    • CVE-2026-85251: Authorization headers are reattached to redirected destinations when followRedirects is enabled, letting a remote server decide which host receives the credentials.
    • The advisories also cover untrusted routing metadata and Kubernetes configuration injection affecting Camel K.

    Remediation

    • Identify the affected components and upgrade to the patched release for each product branch.
    • Camel K needs its own upgrades; framework fixes do not cover the operator.
    • Review publisher permissions, redirect behavior and untrusted message headers against each advisory's prerequisites.
    • Prioritize routes where external input can reach vulnerable consumers, authentication processors or outbound HTTP producers.