Data Exposure Vulnerability in Apache Camel AS2 Component
CVE-2026-85296

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Camel
Vendor
CVE Published:
19 October 2026

What is CVE-2026-85296?

The Apache Camel AS2 component is susceptible to a data exposure issue where signing material intended for one request is improperly shared across multiple requests. This flaw allows concurrent requests from different trading partners to access each other's signing material, leading to potential cross-partner key confusion. As a result, a Message Disposition Notification could be inadvertently signed with another partner's key, compromising the integrity of communications. To mitigate this issue, users are advised to upgrade to Apache Camel version 4.23.0 or respective versions like 4.18.5 and 4.22.1, which contain the necessary fixes. For those unable to upgrade immediately, employing separate Camel contexts per trading partner is recommended to prevent sharing of signing materials.

Affected Version(s)

Apache Camel 4.0.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

References

https://camel.apache.org/security/CVE-2026-85296.html
vendor-advisory
https://issues.apache.org/jira/browse/CAMEL-24429
issue-tracking
https://github.com/apache/camel/pull/25641
patch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude Security
Andrea Cosentino
.