Sensitive Information Leakage in Apache Camel MLLP Component

CVE-2026-85260

What is CVE-2026-85260?

The Apache Camel MLLP component contains a vulnerability allowing sensitive information, including protected health information, to be logged inadvertently. The default setting for the logPhi option is true, which means sensitive HL7 payload content may be recorded in application logs without additional configuration. This can expose patient data to unauthorized access as logs adhere to the general retention and aggregation policies of the application rather than those specific to clinical records. Immediate upgrade to Apache Camel version 4.23.0 or relevant LTS releases is recommended, where the logPhi option defaults to false and is secure across all access paths.

References