Vulnerability · Published Oct 19, 2026 · Assigned by apache
CVE-2026-85313Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set
Medium 4.3
In plain English
A medium-severity security flaw in Apache Camel from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the platform-http-vertx advisory published alongside it, in a different component. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly. For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relying on what enableCORS installs, naming the allowed origins.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Camel | 4.0.0 – before 4.18.54.19.0 – before 4.22.1 |
Weakness: CWE-942 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References
- Apache Camel Security Advisory - CVE-2026-85313 vendor-advisory
- CAMEL-24450 issue-tracking
- Fix on main, released in 4.23.0 (commit 6e3e4ec510b4966c70ad99b3c032e27d6adbef9d) patch
- Backport to camel-4.22.x, released in 4.22.1 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) patch
- Backport to camel-4.18.x, released in 4.18.5 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7) patch