This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch new-wave-of-cves in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit c3db130e9d0aa9a45dafdb2692359a0c60db8c65 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:41 2026 +0200 Added CVE-2026-84176 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-84176.md | 21 ++++++++++++++++++++ content/security/CVE-2026-84176.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-84176.md b/content/security/CVE-2026-84176.md new file mode 100644 index 00000000..da22eb29 --- /dev/null +++ b/content/security/CVE-2026-84176.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-84176" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-84176.html +draft: false +type: security-advisory +cve: CVE-2026-84176 +severity: MEDIUM +summary: "Camel-Platform-HTTP-Vertx: cross-origin credential exposure - Access-Control-Allow-Credentials was set outside the origin check and the caller's own Origin was reflected back when no origin list was configured, producing a credentialed any-origin CORS policy" +description: "createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetc [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24436 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25820 (commit 4b557e4e82048515b0141f4e3594fbecf7dc741c), backported to camel-4.22.x in https://github.com/apache/camel/pull/25937 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) and to camel-4.18.x in https://github.com/apache/camel/pull/25938 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7). + +The issue is classified as CWE-942 Permissive Cross-domain Policy with Untrusted Domains. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-84176.txt.asc b/content/security/CVE-2026-84176.txt.asc new file mode 100644 index 00000000..fd6778cd --- /dev/null +++ b/content/security/CVE-2026-84176.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-84176" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-84176.html +draft: false +type: security-advisory +cve: CVE-2026-84176 +severity: MEDIUM +summary: "Camel-Platform-HTTP-Vertx: cross-origin credential exposure - Access-Control-Allow-Credentials was set outside the origin check and the caller's own Origin was reflected back when no origin list was configured, producing a credentialed any-origin CORS policy" +description: "createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetc [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24436 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25820 (commit 4b557e4e82048515b0141f4e3594fbecf7dc741c), backported to camel-4.22.x in https://github.com/apache/camel/pull/25937 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) and to camel-4.18.x in https://github.com/apache/camel/pull/25938 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7). + +The issue is classified as CWE-942 Permissive Cross-domain Policy with Untrusted Domains. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrUACgkQ406fOAL/ +QQAlngf8CkwyW+UFZ3D7WRScR0xQoBpAeBVdngqIkTU58/aiGY5XfrN93ELTJkJz +aOATa06MmWPp/gB+IoPy/KOZzItHjmaPyDkubZ0XD4RPRUpxBorQKFfWl/nXGSge +kdLa9JS8HH1vzinYHnj5Elh+nl6AKBuaWydZv4zpMjVUe7pL+ZH4/nU51NKqaOpq +T3gUQtK+/pVpqz2ESElcqKlKWUDpEbCQ1CvdDkyBbt+6++6CzO+ZstsSE7K1Zezf +xZRF0MR/hu9GOAa83eFJ6IzKYed5bkOGnpUlYUMsjTIQ1KFW6Kr6pgECKSNZ/PRk +sL12F9glf/+2sNWMNd32cdWiF/r4DA== +=+kFA +-----END PGP SIGNATURE-----
