CVE-2026-84176

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description The HTTP Vertx component contains a permissive cross-domain policy. The createCorsHandler() function sets the Access-Control-Allow-Credentials header to true regardless of whether the origin check passed. When the camel.server.cors.origins variable is unset, the handler allows any origin and reflects the caller's Origin in the Access-Control-Allow-Origin header. This configuration allows pages from any origin to make credentialed cross-origin requests to the endpoint and read the responses.

Recommendations Upgrade Apache Camel versions 4.0.0 through 4.18.4 to 4.18.5. Upgrade Apache Camel versions 4.19.0 through 4.22.0 to 4.22.1. Upgrade to Apache Camel version 4.23.0. Set camel.server.cors.origins to an explicit list of required origins instead of leaving it unset.