CVE-2026-90885— Apache Camel 任意版本 XXE 漏洞
一分钟漏洞结论
影响对象
Apache Software Foundation Apache Camel
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Apache Camel 的 Saxon 组件中存在 XML 外部实体引用（XXE）限制不当的漏洞。 受影响版本范围： Apache Camel 4.0.0 至 4.18.5（不含 4.18.5） Apache Camel 4.19.0 至 4.22.2（不含 4.22.2） 漏洞详情： 在 模块中， 用于评估 XQuery 语言表达式及 xquery 组件。该组件在构建默认的 Saxon 配置时，仅设置了“去除空白字符”的解析选项，而未对 XML 解析器进行其他安全加固。因此，XML 解析器沿用其默认行为：接受
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-90885 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
来源: CVE Program / CVE List V5
Vulnerability Description
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.
XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.0.0 ~ 4.18.5 | - |
|
二、漏洞 CVE-2026-90885 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-90885 的情报信息
请登录查看更多情报信息。
CVE-2026-90885 补丁与修复 (3)
CVE-2026-90885 厂商安全公告 (3)
同批安全公告 · Apache Software Foundation · 2026-10-26 · 共 12 条
| CVE-2026-115748 | 8.8 HIGH | Apache Vysper 未授权访问漏洞 |
| CVE-2026-115721 | 7.5 HIGH | Apache Vysper 无界分配漏洞 |
| CVE-2026-95628 | 5.4 MEDIUM | Apache Camel 路径验证绕过漏洞 |
| CVE-2026-95629 | 5.4 MEDIUM | Apache Camel 任意目录写入漏洞 |
| CVE-2026-95664 | 5.4 MEDIUM | Apache Camel 远程代码执行漏洞 |
| CVE-2026-101259 | 5.3 MEDIUM | Apache Camel CoAP 组件信息泄露漏洞 |
| CVE-2026-94386 | 4.8 MEDIUM | Apache Camel OAuth 跨作用域令牌重用漏洞 |
| CVE-2026-95663 | 4.8 MEDIUM | Apache Camel 远程代码执行漏洞 |
| CVE-2026-111422 | Apache Airflow SSH 远程代码执行漏洞 | |
| CVE-2026-110748 | Apache SIS 路径限制不当漏洞 | |
| CVE-2026-110733 | Apache SIS SQL 特性存储未验证排序表达式 SQL 注入漏洞 |