Insufficient Access Control in Apache Camel HTTP Component
CVE-2026-85316

4.8MEDIUM

Key Information:

Vendor

Apache
Status
Apache Camel
Vendor
CVE Published:
19 October 2026

What is CVE-2026-85316?

The Apache Camel HTTP component contains a vulnerability related to access control granularity. This flaw allows endpoints to be mistakenly recognized as proxy endpoints by evaluating if their paths start with 'proxy', rather than matching paths accurately. Consequently, endpoints intended to serve specific content may inadvertently forward requests, leading to potential security risks such as request forgery and exposure of sensitive information. Users are urged to upgrade to Apache Camel version 4.23.0 or later to address this issue, while those on the 4.18.x LTS should upgrade to 4.18.5, and users on the 4.22.x LTS should upgrade to 4.22.1. For immediate measures, it’s advisable to rename any endpoint paths beginning with 'proxy' if they are not meant to operate in proxy mode.

Affected Version(s)

Apache Camel 4.0.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

References

https://camel.apache.org/security/CVE-2026-85316.html
vendor-advisory
https://issues.apache.org/jira/browse/CAMEL-24455
issue-tracking
https://github.com/apache/camel/pull/25833
patch

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude Security
Andrea Cosentino
.