Insufficient Permissions in Apache Camel PQC Component Affects Privacy

CVE-2026-85300

What is CVE-2026-85300?

An Incorrect Default Permissions vulnerability in the Apache Camel PQC component allows generated key material to have overly permissive file permissions. When the component writes this material to disk, it adheres to the process's default umask settings, which may result in the private key being readable by other local users on systems with permissive umask configurations. This exposure poses a risk to local accounts rather than external threats, as acquiring the private key would compromise all security protocols dependent on it. To mitigate this risk, it is crucial to upgrade to Apache Camel version 4.23.0 or to the latest patches in the 4.18.x and 4.22.x LTS streams. Implementing additional security measures such as adjusting umask settings or restricting access to the key directory can also help protect sensitive information.

References