Sensitive Information Disclosure in Apache Camel Knative Component

CVE-2026-84180

What is CVE-2026-84180?

A sensitive information disclosure vulnerability exists in the Knative component of Apache Camel, versions prior to 4.23.0. When an exchange fails on the consumer side, detailed exception messages—including class names, messages, and stack traces—are sent back to the remote caller. This exposure can lead to targeted attacks by revealing internal details such as file paths and configuration information. Recent updates in Apache Camel align with best practices for HTTP consumers, ensuring that exceptions do not leak sensitive information. To mitigate this issue, users are advised to upgrade to Apache Camel 4.23.0 or the relevant LTS versions.

References