PT-2026-35369 · Apache · Apache Camel

Andrea Cosentino + 1 · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-40048

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.19.0 through 4.19.x Apache Camel versions 4.18.0 through 4.18.1

Description The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of <keyId>.key files in the configured key directory using java.io.ObjectInputStream without applying an ObjectInputFilter or class-loading restrictions. Because the cast to java.security.KeyPair occurs only after the readObject() function has returned, any side effects within the deserialized object are executed before the type check. An attacker with write access to the key directory—potentially achieved via path traversal, misconfigured filesystem permissions, a compromised key provisioning pipeline, or a symlink attack—can place a crafted serialized Java object to achieve arbitrary code execution within the application context.

Recommendations Upgrade to version 4.20.0. Upgrade to version 4.18.2 for users on the 4.18.x LTS releases stream.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-40048

GHSA-V3VG-332R-MW99

Affected Products

Apache Camel

References · 13

• https://camel.apache.org/security/CVE-2026-40048.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40048 · Security Note
• https://osv.dev/vulnerability/GHSA-v3vg-332r-mw99 · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/pull/22034 · Note
• https://github.com/apache/camel/pull/22495 · Note
• https://github.com/apache/camel/commit/5f87a86f4e337efc59248d278c6a5650e73b3b7c · Note
• https://github.com/apache/camel/commit/5bdd0f1d3289dfa78116deec6c81083708bf432d · Note
• https://twitter.com/CVEnew/status/2048852239561740543 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048853774056165734 · Twitter Post
• https://issues.apache.org/jira/browse/CAMEL-23200 · Note
• https://t.me/CVEtracker/51907 · Telegram Post
• http://openwall.com/lists/oss-security/2026/04/26/6 · Note