Apache Camel fixes high-severity XXE, other flaws

Key Takeaways

• Apache Camel has addressed multiple security vulnerabilities, including several high-severity XML External Entity (XXE) flaws.
• The vulnerabilities could lead to local file exposure, access to internal systems, remote code execution, and credential disclosure.
• Affected components include Camel-Saxon, Camel-XPath, Camel-Smooks, Camel-JGroups, Camel-Spring-Redis, and Camel-HTTP.
• Organizations should update to patched versions (e.g., 4.18.5, 4.22.2, 4.23.0) and review their specific component usage.

Apache Camel Addresses Critical Security Flaws Across Multiple Components

The Apache Software Foundation has released a series of patches for its widely used integration framework, Apache Camel, resolving numerous security vulnerabilities. These include several high-severity XML External Entity (XXE) flaws that could potentially expose sensitive local files or grant unauthorized access to internal network systems.

The identified issues span a range of components within the Apache Camel ecosystem. Risks associated with these vulnerabilities vary, encompassing unsafe XML processing, the potential for remote code execution, the theft of sensitive credentials, and failures in access control mechanisms.

According to Apache’s official security advisories, specific patched releases are available for each affected branch. The scope of these fixes is broad, covering diverse parts of the Camel framework. Consequently, an application’s exposure to these risks is directly tied to the particular components and configurations it utilizes.

Cybersecurity teams are strongly advised to consult the individual advisories pertinent to their deployed versions rather than assuming a uniform risk profile across all Camel applications. It’s important to note that many of these flaws necessitate an attacker’s ability to deliver specially crafted messages to a specific processing path within the application.

High-Severity XXE Vulnerabilities Detailed

One critical vulnerability, identified as CVE-2026-90885, impacts the Camel-Saxon component. This flaw arises because its XQueryBuilder processed message bodies, already represented as javax.xml.transform.Source objects, using Saxon’s default parser settings. This configuration inadvertently allowed external entities declared within the XML body to be resolved, thereby creating an XXE vulnerability in that specific processing path.

Apache’s advisory for Camel-Saxon clarifies that CVE-2026-90885 is distinct from CVE-2026-85250, which affects Camel-XPath. The XPath vulnerability manifests when documentType=InputSource is used, passing the payload to an engine that constructs its own parser using default JDK settings. This alternative path could, in turn, accept XML declarations that would otherwise be blocked by the default document type.

A third high-severity issue, CVE-2026-88901, was discovered in Camel-Smooks. By default, its XML reader was configured to resolve both external general and parameter entities, and it also loaded external document type definitions. This configuration meant that a malicious actor could craft an XML message to read local files from the system or establish connections with internal hosts. Additionally, Camel-FOP received a medium-severity XXE fix addressing unsafe handling when certain third-party XML transformer implementations were present.

Broader Update Addresses Remote Code Execution and Credential Theft

Beyond the XXE issues, the comprehensive update addresses several other significant vulnerabilities. CVE-2026-88900 is a high-severity unsafe Java deserialization flaw found in Camel-JGroups, which could be exploited to achieve remote code execution.

Another high-severity vulnerability, CVE-2026-78165, affects Camel-Spring-Redis. This flaw could be exploited by an attacker capable of publishing messages to a subscribed channel, leveraging its default deserializer which lacks an essential object input filter.

Furthermore, Camel-HTTP contains a high-severity credential disclosure vulnerability, tracked as CVE-2026-85251. When the followRedirects option was enabled, the component would append the Authorization header to the destination specified by a redirect. This behavior could allow a remote server to dictate where sensitive credentials were sent. Other fixes in this release address weaknesses in OAuth authentication bypass and Keycloak token validation.

It is worth noting that these recent findings are separate from previously reported Apache Camel header injection vulnerabilities and attacks targeting older Tomcat and Camel flaws. There is no current evidence suggesting that these newly disclosed issues are actively being exploited in the wild.

For the Saxon flaw (CVE-2026-90885), Apache has provided fixes in versions 4.18.5, 4.22.2, and 4.23.0. The XPath (CVE-2026-85250) and Smooks (CVE-2026-88901) issues were rectified in versions 4.18.5, 4.22.1, and 4.23.0.

What You Should Do

• Prioritize Updates: Organizations planning an upgrade should ensure they account for the later Saxon fix, meaning an update to at least 4.22.2 or 4.23.0 is recommended, not stopping at 4.22.1.
• Review Component Usage: Carefully review all deployed XML components, message entry points, and redirect settings within your applications during the patch planning process.
• Verify Coverage: Utilize Apache’s component-specific version ranges to confirm comprehensive coverage, particularly in applications where multiple Camel libraries are bundled.
• Isolate Sensitive Data: Implement network segmentation and least privilege principles to limit the impact should a deserialization or XXE vulnerability be exploited.
• Input Validation: Ensure robust input validation and sanitization for all incoming messages, especially those processed by XML parsers or deserialization routines.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.