PT-2026-35369 · Apache · Apache Camel

·

CVE-2026-40048

·

Published

2026-04-27

·

Updated

2026-07-10

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.19.0 through 4.19.x Apache Camel versions 4.18.0 through 4.18.1
Description The FileBasedKeyLifecycleManager class in Camel-PQC performs insecure deserialization of untrusted data. It deserializes the contents of <keyId>.key files in the configured key directory using java.io.ObjectInputStream without applying an ObjectInputFilter or class-loading restrictions. Because the cast to java.security.KeyPair occurs only after the readObject() function has returned, any side effects within the deserialized object are executed before the type check. An attacker capable of writing to the key directory—via path traversal, misconfigured filesystem permissions, a compromised key provisioning pipeline, or a symlink attack—can place a crafted serialized Java object to achieve arbitrary code execution within the application context.
Recommendations Upgrade to version 4.20.0. Upgrade to version 4.18.2.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-40048
GHSA-V3VG-332R-MW99

Affected Products

Apache Camel