Deserialization Flaw in Apache Camel Consul Component

CVE-2026-27172

What is CVE-2026-27172?

The Consul component of Apache Camel contains a deserialization vulnerability that allows for potentially malicious Java objects to be injected and executed. When an attacker gains write access to the Consul KV store, they can insert such objects, leading to arbitrary code execution when Camel subsequently performs a lookup against the affected registry. This vulnerability exists in versions prior to 4.14.6 and 4.18.1, missing prior patching addressed in previously issued CVEs.

References