CVE-2026-85247

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description An improper certificate validation issue exists in the Knative component. When SSL is enabled on the Knative HTTP client without a configured truststore, the client defaults to trusting all presented certificates instead of using the JVM default trust anchors. This results in an encrypted connection lacking peer authentication, allowing a network-positioned attacker to terminate and read the traffic. This state occurs by omission, meaning enabling TLS inadvertently disables certificate validation.

Recommendations Upgrade to version 4.23.0. Upgrade to version 4.18.5 for users on the 4.18.x LTS stream. Upgrade to version 4.22.1 for users on the 4.22.x LTS stream. As a temporary mitigation, explicitly configure a truststore wherever SSL is enabled.