Sensitive Information Exposure in Apache Camel's CXF Component

CVE-2026-85257

What is CVE-2026-85257?

The vulnerability in Apache Camel's CXF component allows for the generation of error messages that inadvertently include sensitive deployment details. When an undeclared exception occurs within a route behind a CXF SOAP consumer, the internal exception message, including class and package names, is included in the SOAP fault response. This can expose critical implementation details to external callers. To mitigate this, users are advised to upgrade to Apache Camel version 4.23.0, with previous versions 4.18.5 and 4.22.1 providing necessary patches. The muteException option can be utilized to suppress details for undeclared errors, thereby enhancing security by limiting the information disclosed in response to faults.

References