CVE-2026-56139
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Vulnerability in Apache Camel Undertow component causes sensitive information disclosure by returning full stack traces in HTTP responses. The muteException option defaults to false, exposing detailed exceptions on route processing errors. Rest DSL consumers ignore this option entirely, always returning stack traces.
Risk Assessment
An unauthenticated attacker can obtain sensitive information such as credentials, system paths, IP addresses, library versions, and application structure, enabling further attacks.
Recommendation
Upgrade Apache Camel to version 4.21.0, 4.14.8, or 4.18.3 immediately. If upgrade is not possible, explicitly set muteException=true on the camel-undertow consumer, noting that this workaround does not cover Rest DSL consumers.
Other vulnerabilities in Apache Camel
See all- CVE-2015-5348High
Apache Camel versions 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using camel-jetty or camel-servlet as consumers in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
- CVE-2014-0002High
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- CVE-2026-71300Critical
Vulnerability in Apache Camel Atmosphere Websocket component due to improper input validation of Exchange headers outside the Camel namespace (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType). An external attacker can supply the list header via HTTP and take over the producer's dispatch decision, potentially suppressing or redirecting notifications to a different client.
- CVE-2026-66906Critical
Relative path traversal vulnerability in Apache Camel Azure Storage Blob component allows writing files outside the configured directory during downloadBlobToFile operation. Blob names with parent-directory segments are not normalized, enabling overwriting arbitrary files with Camel process privileges.
- CVE-2026-56140Critical
The Apache Camel AWS SNS component lacks an inbound filter rule in the Sns2HeaderFilterStrategy. However, the vulnerability is not exploitable because the component is producer-only (does not support consumers), so an attacker cannot supply external message attributes to the Camel Exchange. A defense-in-depth filter was added for consistency with other strategies.
- CVE-2026-53913Critical
A vulnerability in the camel-keycloak component of Apache Camel allows bypassing access token verification in the default configuration. When required roles or permissions are empty, the token is not cryptographically verified, allowing access to protected routes with any Authorization header.
- CVE-2026-48205Critical
A vulnerability in the Apache Camel DNS component allows SSRF attacks via improper input validation of message headers. An attacker can set dns.server, dns.name, and dns.domain headers in an HTTP request, redirecting DNS queries to a controlled server and disclosing internal hostnames.
- CVE-2026-48204Critical
Vulnerability in Apache Camel's mongodb-gridfs component allows an attacker to manipulate GridFS operations via HTTP headers. Improper input validation and access control enable unauthorized file deletion, reading, enumeration, and NoSQL operator injection.
- CVE-2026-48203Critical
Vulnerability in Apache Camel Solr component allows SSRF and injection of Solr parameters and fields. Exchange headers with SolrParam. and SolrField. prefixes are passed unfiltered from HTTP requests to the Solr producer, enabling attackers to manipulate queries and indexed documents.
- CVE-2026-46456Critical
Vulnerability in Apache Camel AWS2-SQS component allows attackers to inject Camel control headers (e.g., CamelHttpUri, CamelFileName) via SQS messages. Missing inbound filtering in Sqs2HeaderFilterStrategy enables modification of downstream producer behavior in the route.
Original NVD description (English source)
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false, whereas the other Camel HTTP server components (camel-http / camel-jetty / camel-servlet and camel-platform-http) default it to true. With muteException=false, when a request triggers an exception during route processing the consumer writes the full Throwable stack trace into the HTTP response body as text/plain instead of returning an empty body. Any unauthenticated client that can reach the endpoint and cause a processing error - for example by sending a malformed request body, an invalid parameter, or otherwise triggering a route-internal failure - therefore receives a complete Java stack trace. Such a stack trace can disclose sensitive internal information, including credentials embedded in exception messages, internal host names and IP addresses, filesystem paths, dependency and version details, database and class names, and the application's internal structure, which an attacker can use to plan further attacks. In addition, for Rest DSL consumers the muteException option was not honoured at all: the RestUndertowHttpBinding was created with a hard-coded false, so the stack trace was returned even when muteException=true had been configured. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, set muteException=true explicitly on the camel-undertow consumer (for example undertow: http://0.0.0.0:8080/api?muteException=true , or globally via the camel.component.undertow.mute-exception=true property), so that processing errors no longer return the stack trace to the client; note that on affected releases this workaround does not cover Rest DSL consumers, whose binding ignores the option until the fix is applied.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS