Permissive Cross-domain Policy Vulnerability in Apache Camel HTTP Vertx Component
CVE-2026-84176

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Camel
Vendor
CVE Published:
19 October 2026

What is CVE-2026-84176?

The Apache Camel HTTP Vertx component exhibits a permissive cross-domain policy vulnerability due to improper handling of CORS requests. Specifically, the configuration allowed credentialed cross-origin requests from untrusted domains by sending Access-Control-Allow-Credentials: true without a valid origin check. If the camel.server.cors.origins configuration is unset, it treats all origins as allowed, leading to potential exposure of sensitive data through unauthorized access. To mitigate this issue, it is crucial to upgrade to Apache Camel version 4.23.0 or to 4.18.5 for LTS users. Until an upgrade is possible, operators should explicitly configure camel.server.cors.origins to restrict access.

Affected Version(s)

Apache Camel 4.0.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

References

https://camel.apache.org/security/CVE-2026-84176.html
vendor-advisory
https://issues.apache.org/jira/browse/CAMEL-24436
issue-tracking
https://github.com/apache/camel/pull/25820
patch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude Security
Andrea Cosentino
.