Sensitive Information Exposure in Apache Camel gRPC Component

CVE-2026-85315

What is CVE-2026-85315?

A vulnerability in the gRPC component of Apache Camel allows sensitive information to be transmitted back to the client when an error occurs. Specifically, when a route behind a gRPC consumer fails, the exception message leaks into the gRPC status description, disclosing internal details such as class names, paths, host names, and connection information. This exposure can lead to information disclosure attacks. To mitigate this issue, users are advised to upgrade to Apache Camel version 4.23.0 or to specific patched versions for the 4.18.x and 4.22.x LTS releases. Additionally, deploying the 'muteException' consumer option, which defaults to true, will prevent sensitive information from being shared.

References