This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 6cec27fa12e2584ee73f331e39c806db9d708f30 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:42 2026 +0200 Added CVE-2026-85251 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-85251.md | 21 ++++++++++++++++++++ content/security/CVE-2026-85251.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-85251.md b/content/security/CVE-2026-85251.md new file mode 100644 index 00000000..10e9e506 --- /dev/null +++ b/content/security/CVE-2026-85251.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-85251" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85251.html +draft: false +type: security-advisory +cve: CVE-2026-85251 +severity: HIGH +summary: "Camel-HTTP: credential disclosure - with followRedirects enabled the Authorization header was re-attached to whatever host the Location header named, so the remote server chose which host received the credentials" +description: "Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequestInterceptorFirst, and HttpClient runs protocol-level request interceptors inside ProtocolExec, which sits below RedirectExec in the exec chain; the interceptor therefore ran again for every redirect hop and re-attached Authorization: Bearer <token> to whatever host [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Credentials are now sent only to the authority the endpoint was configured with, and are not re-attached when a redirect crosses to another host. For deployments that cannot upgrade immediately, set followRedirects=false on endpoints that carry credentials, and handle any redirect explicitly [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24452 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25830 (commit 3a6c27bfae04e528f5a76494db6d6d97b9234551), backported to camel-4.22.x in https://github.com/apache/camel/pull/25937 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) and to camel-4.18.x in https://github.com/apache/camel/pull/25938 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7). + +The issue is classified as CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-85251.txt.asc b/content/security/CVE-2026-85251.txt.asc new file mode 100644 index 00000000..6e701b7f --- /dev/null +++ b/content/security/CVE-2026-85251.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-85251" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85251.html +draft: false +type: security-advisory +cve: CVE-2026-85251 +severity: HIGH +summary: "Camel-HTTP: credential disclosure - with followRedirects enabled the Authorization header was re-attached to whatever host the Location header named, so the remote server chose which host received the credentials" +description: "Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequestInterceptorFirst, and HttpClient runs protocol-level request interceptors inside ProtocolExec, which sits below RedirectExec in the exec chain; the interceptor therefore ran again for every redirect hop and re-attached Authorization: Bearer <token> to whatever host [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Credentials are now sent only to the authority the endpoint was configured with, and are not re-attached when a redirect crosses to another host. For deployments that cannot upgrade immediately, set followRedirects=false on endpoints that carry credentials, and handle any redirect explicitly [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24452 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25830 (commit 3a6c27bfae04e528f5a76494db6d6d97b9234551), backported to camel-4.22.x in https://github.com/apache/camel/pull/25937 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) and to camel-4.18.x in https://github.com/apache/camel/pull/25938 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7). + +The issue is classified as CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrYACgkQ406fOAL/ +QQC0+gf9GFcbLlurSSYEpkL15hLp7lrwpeO5EAfG5TIuYTySYVWjtj2sdtbKvEii +bfiZGpw7vPTXwfLCrixvDMSpa4TJNnji58IMDcKwe5sr0GbNz6rHJ23VrqoAB/9G +qhvDyxkiudVRCp+hwbV5GBpe1e1TexTuMsftIfFt/Z2aRDFg+jzluWodCw71dtq9 +iuybdzbDAWoUr+rtTD9xmHHg5KQBx+Lbc7no90BE/PaX0Mo1HD6N1WFt1ZxEBRiV +M8y5P9V7/VGGkRzvl6oN8pcnEpjpIuTdCCwziCDig4mvdO5+y9M6BYv/Rf8K2zYq +e3j7C+rGhvP072C+Q+YcEnNKF2Z/Qw== +=ynjf +-----END PGP SIGNATURE-----
