CVE-2026-46590

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.18.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.x

Description Deserialization of untrusted data in the Apache Camel PQC component occurs when HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and FileBasedKeyLifecycleManager read key metadata from secret backends. These components use java.io.ObjectInputStream.readObject() to deserialize Base64-wrapped values without an ObjectInputFilter or class allow-list. An attacker with write access to the HashiCorp Vault KV path or AWS Secrets Manager secret can store a crafted serialized object. When the application performs normal key-lifecycle operations, the object is deserialized, potentially leading to remote code execution in the application context.

Recommendations Upgrade to version 4.18.3 for those on the 4.18.x LTS release stream. Upgrade to version 4.21.0. Restrict write access to the key backend so only the application identity can write secrets using least-privilege HashiCorp Vault policies and secretsmanager:PutSecretValue IAM permissions. Store PQC key material in a backend separate from data accessible to less-trusted principals.