Improper Certificate Validation in Apache Camel by Apache

CVE-2026-85247

What is CVE-2026-85247?

An improper certificate validation issue exists in the Apache Camel Knative component. When using SSL with an unconfigured truststore, the client defaults to trusting all provided certificates instead of adhering to the JVM's default trust anchors. This situation poses serious security risks, as a malicious actor can intercept and examine encrypted connections without proper peer authentication. The vulnerability arises from a design flaw where enabling TLS unintentionally disables certificate validation. It's crucial for users to upgrade to Apache Camel version 4.23.0 or apply patches for earlier versions to ensure secure and authenticated SSL connections.

References