Apache Camel has addressed several critical security vulnerabilities, including XML External Entity (XXE) issues. These vulnerabilities could potentially expose sensitive local files or compromise internal systems.
Details of the Vulnerabilities
The identified vulnerabilities span various components of Apache Camel, posing risks such as unsafe XML processing, potential remote code execution, credential theft, and failed access controls. Apache’s security advisories provide detailed information on the patched releases for each affected branch.
It is crucial for teams to verify their deployed versions against these advisories, as the risk exposure varies based on the specific application components and configurations used.
Significant Security Issues
One major vulnerability, CVE-2026-90885, impacts Camel-Saxon. This issue arises when XQueryBuilder processes message bodies represented as javax.xml.transform.Source objects, allowing external entities to be resolved and creating an XXE vulnerability.
A separate issue, CVE-2026-85250, is found in Camel-XPath. This flaw occurs when documentType=InputSource passes the payload to an engine using JDK default parsers, potentially accepting XML declarations through an alternative path.
Additional Vulnerabilities Addressed
Another critical issue, CVE-2026-88901, affects Camel-Smooks, where its default XML reader resolves external entities and loads external document type definitions, posing a risk of local file exposure or internal system access.
Camel-FOP received a medium-severity fix for unsafe handling in the presence of certain third-party XML transformers. Additional high-severity flaws include CVE-2026-88900 in Camel-JGroups, leading to remote code execution, and CVE-2026-78165 in Camel-Spring-Redis, where a default deserializer without an object input filter could be exploited.
Recommendations for Organizations
For organizations using Apache Camel, it is recommended to upgrade to the latest patches, specifically focusing on versions 4.18.5, 4.22.2, and 4.23.0, which address the Saxon flaw. It is vital to review XML components, message entry points, and redirect settings during patch planning.
Ensuring that your systems are updated in line with Apache’s component-specific version ranges will help mitigate risks, especially when multiple Camel libraries are integrated into a single application.
Proactively incorporating threat intelligence and monitoring alerts can aid in swiftly stopping incidents and reinforcing security defenses.
