Skip to content
OpenAdvisories
Medium WID-SEC-2026-4146 7 CVEs

Apache Camel: Mehrere Schwachstellen

Published Oct 25, 2026 · Updated Oct 25, 2026 · de-DE

Vendor: Apache Product: Camel Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um Informationen offenzulegen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.

Product

Apache Camel ist ein Integrations-Framework, das Enterprise Integration Patterns implementiert.

Vulnerabilities 7

  • High 7.5
    CVE-2026-90885 Public exploit

    Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

    Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery…

    Apache Software Foundation Apache Camel
  • Medium 5.4
    CVE-2026-95628 Public exploit

    Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer builds the command line of t…

    Apache Software Foundation Apache Camel
  • Medium 5.4
    CVE-2026-95629 Public exploit

    Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer runs the external docling to…

    Apache Software Foundation Apache Camel
  • Medium 5.4
    CVE-2026-95664 Public exploit

    Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

    Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For t…

    Apache Software Foundation Apache Camel
  • Medium 5.3
    CVE-2026-101259 Public exploit

    Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

    Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route…

    Apache Software Foundation Apache Camel
  • Medium 4.8
    CVE-2026-94386 Public exploit

    Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

    Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2. OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through the client credentials grant o…

    Apache Software Foundation Apache Camel
  • Medium 4.8
    CVE-2026-95663 Public exploit

    Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

    Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useToken…

    Apache Software Foundation Apache Camel

Revision history

  1. #1

    Initiale Fassung

References