Code Injection and Expression Language Injection Vulnerability in Apache Camel

CVE-2026-83531

What is CVE-2026-83531?

A vulnerability exists in Apache Camel where improper handling of code generation can lead to code injection and expression language injection. This affects versions of Apache Camel between 4.4.0 and 4.18.5, as well as between 4.19.0 and 4.22.1. The Dynamic Router Control endpoint allows malicious actors to exploit the system by sending control messages that include arbitrary expressions, evaluated with the privileges of the Camel process. This flaw highlights the importance of ensuring senders of control messages are trusted, as it poses risks particularly when untrusted messages can be forwarded to the dynamic-router-control endpoint. Users are urged to upgrade to version 4.23.0 or respective updates for earlier versions to secure their installations.

References