Venkatraman Kumar

The `UrlImageConverter` component is susceptible to Server-Side Request Forgery (SSRF) via a DNS rebinding bypass. This occurs when an application accepts an attacker-controlled image URL for spreadsheet writing; the converter validates the resolved IP addresses of the hostname but subsequently opens a separate connection that may resolve the hostname again. An attacker controlling DNS responses can redirect the connection to a restricted address after the initial validation.

A general user can mint admin access tokens through the '/access-tokens' endpoint.

An unauthenticated REST disclosure allows the exposure of certain content items within the application.

An authenticated tenant can perform Server-Side Request Forgery (SSRF) by registering a template that points to a malicious metalink file containing internal targets, allowing the Secondary Storage VM to retrieve and persist this data. Additionally, a tenant with the default User role can achieve Remote Code Execution (RCE) as root on the KVM hypervisor host. This occurs when a user registers a VM template with the `directDownload` variable set to true and a URL pointing to a .metalink file; the management server fetches the XML and dispatches the download to the KVM agent without re-validating the inner URLs against the scheme allowlist.

☕ Apache Camel critical alert: CVE-2026-43867 hits the camel-pqc component. Post-quantum key metadata deserialized via ObjectInputStream with zero ObjectInputFilter — unauthenticated RCE risk at CVSS 9.8. Check your Camel builds now. #AppSec #Apache https://t.co/iaMBNrOfI0 https://t.co/mkIJ19Sd5Y

An issue exists where the default ObjectInputFilter pattern used for deserialization filtering in several components allows classes that perform network I/O, such as `java.net.URL` and `java.net.InetAddress`. An attacker can send a Java-serialized payload containing a `HashMap` with `java.net.URL` keys to an affected consumer. This triggers the JVM to issue DNS queries to an attacker-controlled host during deserialization, creating an out-of-band side channel. The risk is most significant in the `camel-jms` family because the `extractBodyFromJms()` function in `JmsBinding` unconditionally invokes `getObject()` when the `mapJmsMessage` variable is set to true. Affected components include `camel-jms`, `camel-sjms`, `camel-amqp`, `camel-mina`, `camel-netty`, `camel-netty-http`, `camel-vertx-http`, `camel-infinispan`, and aggregation repository components `camel-leveldb`, `camel-cassandraql`, `camel-consul`, and `camel-sql`.

The `camel-vertx-http` component deserializes HTTP response bodies with the `application/x-java-serialized-object` Content-Type using a raw `java.io.ObjectInputStream` without an `ObjectInputFilter` in the `deserializeJavaObjectFromStream()` function. This occurs when the producer endpoint is configured with `transferException=true` (or `allowJavaSerializedObject=true`) and `throwExceptionOnFailure` is set to true. In these conditions, a backend HTTP response with a 5xx status and the specified content type is deserialized without class restrictions. An attacker controlling the backend or performing a man-in-the-middle attack on an unencrypted HTTP connection can send a crafted serialized Java object to achieve remote code execution on the host, provided a suitable gadget chain exists on the classpath.

The `EndpointReferenceUtils` and `W3CMultiSchemaFactory` classes construct a `SAXParserFactory` without the required JAXP hardening configurations. This allows for out-of-band (OOB) external entity resolution, a process where an XML parser is tricked into accessing external resources via external entities.

Deserialization of untrusted data in the Java replace-resolve path on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks. By using crafted Fory serialized data, an attacker can invoke `readResolve()` and `readExternal()` hooks present on the classpath.

The `FileBasedKeyLifecycleManager` class in Camel-PQC performs insecure deserialization of untrusted data. It deserializes the contents of `<keyId>.key` files in the configured key directory using `java.io.ObjectInputStream` without applying an `ObjectInputFilter` or class-loading restrictions. Because the cast to `java.security.KeyPair` occurs only after the `readObject()` function has returned, any side effects within the deserialized object are executed before the type check. An attacker capable of writing to the key directory—via path traversal, misconfigured filesystem permissions, a compromised key provisioning pipeline, or a symlink attack—can place a crafted serialized Java object to achieve arbitrary code execution within the application context.

The `extractBodyFromJms()` function in `camel-jms` and the `JmsBinding` class in `camel-sjms` deserialize the payload of incoming JMS ObjectMessage values via `javax.jms.ObjectMessage.getObject()` without using an ObjectInputFilter, class allowlist, or class denylist. This occurs when the `mapJmsMessage` option is enabled and the application acts as a JMS consumer. An attacker could publish a crafted ObjectMessage to a queue or topic to achieve remote code execution if a deserialization gadget chain is present on the classpath. This issue also affects `camel-sjms2`, `camel-amqp`, `camel-activemq`, and `camel-activemq6`.

A flaw in the `resolveClass()` function of `AbstractIoBuffer` allows a bypass of the classname allowlist for static classes or primitive types. This occurs because one of the execution branches fails to validate the class, enabling unsafe deserialization when applications call `IoBuffer.getObject()`. This can lead to remote code execution.

An issue exists in the `getObject()` function of the `AbstractIoBuffer` class due to an incomplete deserialization mechanism. The classname allowlist, which restricts which classes can be deserialized, is applied too late, potentially allowing a static initializer in a class to be executed before the check occurs. This flaw allows a remote attacker to execute arbitrary code on applications that call the `getObject()` function.

A flaw in the camel-mina component allows a remote attacker to achieve arbitrary code execution by sending a specially crafted serialized Java object over the network to the MINA consumer port. The `MinaConverter.toObjectInput()` type converter, used when a Camel route processes network input, fails to apply necessary security filters or class-loading restrictions during object deserialization. This occurs when the converter wraps an `IoBuffer` in a `java.io.ObjectInputStream` without an `ObjectInputFilter`, enabling malicious code execution within the application context during the `readObject()` process.