CVE-2026-85251— Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
Quick assessment
Affected
Apache Software Foundation Apache Camel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Camel HTTP 组件存在“敏感信息向未授权方暴露”漏洞。 受影响版本：Apache Camel 4.0.0 至 4.18.5（不含）以及 4.19.0 至 4.22.1（不含）。 当启用 时，两条处理路径会将凭证传递给重定向目标。该目标主机由远程服务器决定，而非由路由配置决定。具体而言， 通过 注册了其拦截器，而 在 内部执行协议级请求拦截器；由于 位于执行链中 的下游，该拦截器会在每次重定向跳转时再次执行，并将 头附加到 头所指定的任意主机。此外，凭证被注册到一个匹配任意主机的 ，因此基本认证
Possible ATT&CK Techniques 3 AI
T1056.004 · Credential API Hooking T1003.001 · LSASS Memory T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.0.0< 4.18.5 |
affected |
4.19.0< 4.22.1 |
affected | ||
4.18.5 |
unaffected | ||
4.22.1 |
unaffected | ||
4.23.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85251
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
Source: CVE Program / CVE List V5
Vulnerability Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequestInterceptorFirst, and HttpClient runs protocol-level request interceptors inside ProtocolExec, which sits below RedirectExec in the exec chain; the interceptor therefore ran again for every redirect hop and re-attached Authorization: Bearer to whatever host the Location header named. Separately, credentials were registered against an AuthScope matching any host, so basic and digest credentials were presented to a redirect target as well. A remote endpoint - or anyone who can influence its responses - could therefore collect the bearer token or the configured credentials simply by answering with a redirect to a host it controls.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Credentials are now sent only to the authority the endpoint was configured with, and are not re-attached when a redirect crosses to another host. For deployments that cannot upgrade immediately, set followRedirects=false on endpoints that carry credentials, and handle any redirect explicitly in the route so that the destination is chosen by the route rather than by the remote server.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.0.0 ~ 4.18.5 | - |
|
II. Public POCs for CVE-2026-85251
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85251
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-85251 (3)
Vendor Advisories for CVE-2026-85251 (2)
Same Patch Batch · Apache Software Foundation · 2026-10-19 · 62 CVEs total
| CVE-2026-78162 | 10.0 CRITICAL | Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incom |
| CVE-2026-88900 | 8.8 HIGH | Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroup |
| CVE-2026-83531 | 8.8 HIGH | Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplie |
| CVE-2026-78165 | 8.8 HIGH | Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads |
| CVE-2026-80312 | 8.2 HIGH | Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors |
| CVE-2026-80344 | 8.2 HIGH | Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchro |
| CVE-2026-80343 | 8.2 HIGH | Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path |
| CVE-2026-78164 | 8.2 HIGH | Apache Camel: HTTP producers resolve property placeholders in message-supplied URI overrid |
| CVE-2026-88901 | 8.2 HIGH | Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by d |
| CVE-2026-85250 | 7.5 HIGH | Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the docum |
| CVE-2026-79984 | 7.4 HIGH | Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name repo |
| CVE-2026-79985 | 7.4 HIGH | Apache Camel: camel-smb resolved the remote path of a polled file from the name reported i |
| CVE-2026-79986 | 7.4 HIGH | Apache Camel: camel-azure-files resolved the remote path of a polled file from the name re |
| CVE-2026-79983 | 7.4 HIGH | Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported i |
| CVE-2026-91858 | 6.5 MEDIUM | Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input Wh |
| CVE-2026-84176 | 6.5 MEDIUM | Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Orig |
| CVE-2026-85249 | 6.5 MEDIUM | Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata |
| CVE-2026-85314 | 6.5 MEDIUM | Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMult |
| CVE-2026-85296 | 6.5 MEDIUM | Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State |
| CVE-2026-85254 | 6.5 MEDIUM | Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name |
Showing top 20 of 62 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Camel
-
CVE-2026-88900
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of -
CVE-2026-91858
Apache Camel: Camel-FOP Resolves External DTDs and Entities -
CVE-2026-88901
Apache Camel: Camel-Smooks XML External Entity Processing, e -
CVE-2026-85317
Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under -
CVE-2026-85316
Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via
Same vendor: Apache Software Foundation
-
CVE-2026-88900
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of -
CVE-2026-91858
Apache Camel: Camel-FOP Resolves External DTDs and Entities -
CVE-2026-88901
Apache Camel: Camel-Smooks XML External Entity Processing, e -
CVE-2026-85317
Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under -
CVE-2026-85316
Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via
Same weakness: CWE-200
-
CVE-2026-112781
Grav 2.0.0 before 2.2.2 Information Disclosure via Form conf -
CVE-2026-112771
Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist By -
CVE-2026-107187
Eptura Archibus Workflow Rule Enables Unauthenticated Databa -
CVE-2026-111056
FOSSBilling: Unauthenticated client account enumeration via -
CVE-2026-112147
ai-genius-automations octoally index.ts information disclosu
V. Comments for CVE-2026-85251
No comments yet