Apache Camel: Seven Vulnerabilities Disclosed, Including High-Severity XXE Flaw
Apache Camel released fixes for seven vulnerabilities on October 26, 2026, including a critical XXE flaw and several medium-severity issues impacting various components.
Key findings
- Apache Camel addressed seven vulnerabilities on October 26, 2026, including a high-severity XXE flaw.
- The vulnerabilities affect multiple components such as Saxon, AWS2-s3, Docling, Oauth, Keycloak, and CoAP.
- Affected versions range from Apache Camel 4.0.0 up to, but not including, 4.18.5 and 4.22.2.
- Patches are available in Apache Camel versions 4.18.5 and 4.22.2, depending on the affected component.
- Risks include information disclosure, path traversal, and authentication bypass.
On October 26, 2026, Apache released security updates addressing seven vulnerabilities in its Apache Camel integration framework. The disclosures, spanning a six-hour window, include a high-severity XML External Entity (XXE) flaw and several medium-severity issues affecting various components. These vulnerabilities could potentially lead to information disclosure, path traversal, and authentication bypass, depending on the specific components and configurations used within an Apache Camel application.
One of the most critical vulnerabilities disclosed is CVE-2026-90885, a high-severity XXE flaw within the Apache Camel Saxon component. This vulnerability, affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2, arises from improper restriction of XML external entity references. Exploitation could allow an attacker to access local files or internal systems.
Several other medium-severity vulnerabilities were also patched. CVE-2026-95629 and CVE-2026-95628, both affecting the Apache Camel Docling component, are path traversal vulnerabilities. These flaws, present in versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.2, could allow attackers to access or modify files outside of the intended directory.
Additionally, CVE-2026-95664, an Expression Language Injection vulnerability in the AWS2-s3 component, impacts versions from 4.8.0 before 4.18.5 and from 4.19.0 before 4.22.2. This could allow for injection of malicious expressions. CVE-2026-94386, a medium-severity vulnerability in the Oauth component, involves the use of a cache containing sensitive information, affecting versions from 4.19.0 before 4.22.2.
The Keycloak component is affected by CVE-2026-95663, an Insufficient Session Expiration vulnerability impacting versions from 4.16.0 before 4.18.5 and from 4.19.0 before 4.22.2. This could lead to session hijacking if not properly managed. Lastly, CVE-2026-101259, a medium-severity vulnerability in the CoAP component, involves the generation of error messages containing sensitive information, affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2.
Apache has released patches for these vulnerabilities, with specific version numbers provided in their security advisories. For the XXE vulnerability (CVE-2026-90885), versions 4.18.5 and 4.22.2 are noted as patched releases. Similarly, other components have received fixes in versions 4.18.5 and 4.22.2, depending on the affected branch. Users are advised to consult the individual advisories for precise version information and apply the necessary updates to mitigate these risks.
The coordinated disclosure of these vulnerabilities highlights the importance of regularly updating Apache Camel to the latest patched versions. The range of affected components and vulnerability types underscores the need for organizations to assess their specific Camel deployments and configurations to understand their exposure. Prompt application of security patches is crucial to protect against potential exploitation.