Permissive Cross-domain Policy Vulnerability in Apache Camel Jetty Component
CVE-2026-85313

4.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Camel
Vendor
CVE Published:
19 October 2026

What is CVE-2026-85313?

A vulnerability exists within the Jetty component of Apache Camel due to a permissive cross-domain policy configuration that defaults to allowing all origins when CORS is enabled. This misconfiguration can enable any webpage to make credentialed cross-origin requests to the endpoint and access sensitive responses. Affected versions include Apache Camel from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. To mitigate this risk, it is crucial to upgrade to Apache Camel 4.23.0 or to the appropriate 4.18.x or 4.22.x LTS versions. For those unable to upgrade immediately, explicit configuration of the CrossOriginFilter is necessary to ensure only designated origins are permitted.

Affected Version(s)

Apache Camel 4.0.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

References

https://camel.apache.org/security/CVE-2026-85313.html
vendor-advisory
https://issues.apache.org/jira/browse/CAMEL-24450
issue-tracking
https://github.com/apache/camel/pull/25829
patch

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude Security
Andrea Cosentino
.