oscerd commented on code in PR #28088:
URL: https://github.com/apache/camel/pull/28088#discussion_r4312052134
##########
docs/user-manual/modules/ROOT/pages/security-model.adoc:
##########
@@ -318,47 +346,65 @@ which protective property it breaks.
| Untrusted data is never turned into executed code or OS commands
| A crafted message, header or attachment causes a deserialisation gadget
chain, a bean / method / command dispatch, an expression/template evaluation
the route author never requested, or is spliced into the argument vector of an
external process the component launches
-| Critical (CVSS 9.0-10.0)
+| Medium to High
| Untrusted data cannot redirect the route to a different endpoint, bean,
method or command
-| A control header injected from the wire changes where the exchange is
dispatched, which operation runs, or which transport and credentials are used -
whether it is spelled inside the internal namespace (`CamelBeanMethodName`,
`CamelExecCommandExecutable`, `CamelHttpUri`, `CamelJmsDestinationName`, ...)
or outside it (`websocket.connectionKey`, `+gridfs.*+`, `irc.sendTo`,
`operationName`, `+mail.smtp.*+`, ...)
-| Critical (CVSS 9.0-9.8)
+| A control header injected from the wire changes where the exchange is
dispatched, which operation runs, which saga it joins, or which transport and
credentials are used - whether it is spelled inside the internal namespace
(`CamelBeanMethodName`, `CamelExecCommandExecutable`, `CamelHttpUri`,
`CamelJmsDestinationName`, ...) or outside it (`websocket.connectionKey`,
`+gridfs.*+`, `irc.sendTo`, `operationName`, `+mail.smtp.*+`,
`Long-Running-Action`, ...)
+| Medium to High
| Untrusted data is never deserialised into arbitrary Java types
| A consumer, type converter or persisted-state repository instantiates
attacker-chosen classes through `ObjectInputStream` / XStream / Hessian /
polymorphic Jackson without an effective filter
-| Critical when gadget-reachable (9.0-9.8); High otherwise (7.0-8.6)
+| Medium to High
| Untrusted parsing does not resolve external or remote resources
| An XML / XSLT / XSD / XPath parse of attacker input reads a local file,
performs SSRF, or fetches a remote DTD or stylesheet by default
-| High (CVSS 7.5-8.6); Critical if it yields RCE or credential theft
+| Medium to High
+
+| Untrusted input does not choose the host Camel connects to or the file it
reads, and the endpoint's credentials go only to the hosts the route configured
+| A message body is read as a URL to fetch or a path to read, an address the
peer supplies becomes the destination of an outbound request, or a redirect
carries the endpoint's credentials to a host the remote server chose
+| Medium to High
| Untrusted file names or URI components cannot escape the configured root
-| A file / mail / FTP / object-store consumer or producer reads or writes a
path outside the configured directory via `../` or an absolute path, whether
that name arrived in a header or was reported back by the remote store
-| High (CVSS 7.5-8.8)
+| A file / mail / FTP / object-store consumer or producer reads or writes a
path outside the configured directory via `../` or an absolute path, whether
that name arrived in a header or was reported back by the remote store -
including a remote-file consumer that retrieves, deletes or renames a file on
the server outside the polled directory because of a name in the server's
listing
+| Medium to High
| Components that advertise authentication or authorization actually enforce it
-| A request is served without a valid token, with an unvalidated issuer /
audience / signature, on a sub-path the auth handler was assumed to cover,
because a check was silently skipped when its option was left unconfigured, or
because the authorization decision was computed from a differently-normalized
value than the dispatch decision
-| Critical (CVSS 9.0-9.8)
+| A request is served without a valid token, with an unvalidated issuer /
audience / signature, or on a sub-path the auth handler was assumed to cover.
Typical causes: a check was silently skipped because its option was left
unconfigured or the claim it checks was absent; a failed check did not stop the
exchange; an authentication that an earlier exchange left on the thread was
reused; or the authorization decision was computed from a
differently-normalized value than the dispatch decision
+| Medium to High
+
+| Components that verify an integrity code, or a signature the receiver
requires, fail closed
+| A message is accepted as unmodified, or as signed when a signature is
required, although the check was skipped because the sender chose a format
without it, or was computed over another exchange's data
+| Medium
+
+| One exchange's data, keys and authority do not reach another
+| A body, a signing key, a token or a thread-bound authentication left by one
exchange is observed or used while another sender's, tenant's or partner's
exchange is processed
+| Medium
| Secrets and internal Exchange state are not disclosed
-| Credentials, message bodies or configuration values reach a log, an event, a
world-readable file, or an HTTP response visible to a lower-privileged party
-| Medium to High (CVSS 5.3-8.2), depending on what leaks
+| Credentials, message bodies or configuration values reach a log, an event, a
file that other local accounts can read, or a response visible to a
lower-privileged party
+| Low to Medium
| Untrusted input is not spliced into a back-end query language Camel builds
| Camel constructs a Cypher / XSLT-extension / similar query and the attacker
alters its structure rather than only its data
-| High to Critical (CVSS 8.1-9.8)
+| Medium
| All of the above hold with zero security configuration
| Any of the above is reachable simply by adding the component to a route and
sending a message, with no risky option explicitly set
| Severity of the underlying class; always in scope
|===
-The tiers above are *indicative*, reflecting how the Camel PMC has historically
-scored these classes. The PMC assigns the definitive CVSS vector per report
-based on attack vector, the configuration required to reach the code path, and
-the concrete impact demonstrated. A finding that needs an unusual non-default
-configuration, or whose impact is limited, may score lower than the tier
-suggests; one that chains into full host compromise may score higher.
+The tiers above are *indicative*: for each class they give the range of
+severities the Camel PMC has published at link:/security/[] since 2015 for the
+artifacts this page covers. The three Critical ratings in that record date
+from 2013 and 2014 (CVE-2013-4330, CVE-2014-0002, CVE-2014-0003), and
+CVE-2026-56140 was published as Low, as hardening alongside a sibling finding.
Review Comment:
Applied as suggested in fd3d9918b946: the note under the severity table now
names CVE-2026-80351 and CVE-2026-80352 and says they are triaged against Camel
K's own scope, so the count a reader sees on the index matches the page. Thanks!
_Claude Code on behalf of oscerd_
##########
docs/user-manual/modules/ROOT/attachments/security-model.yaml:
##########
@@ -124,39 +138,69 @@ config_variants:
- option: hostnameVerificationEnabled
insecure_value: false
default: component-dependent
+ - option: requireIntegrityProtection # camel-crypto-pgp
+ insecure_value: false
+ default: true # CVE-2026-85243
+ - option: allowPredicateFromMessage # dynamic-router-control
+ insecure_value: true
+ default: false # CVE-2026-83531; security = insecure:dev
+ - option: allowUrlSource # camel-docling
+ insecure_value: true
+ default: false # CVE-2026-78163; security = insecure:dev
+ - option: allowFilePathSource # camel-docling
+ insecure_value: true
+ default: false # CVE-2026-78163; security =
insecure:dev; inputBaseDirectory (unset by default) confines paths when set
+ - option: allowExternalEntities # camel-smooks
+ insecure_value: true
+ default: false # CVE-2026-88901; security = insecure:dev
on the smooks: endpoint
+ - option: logPhi # camel-mllp
+ insecure_value: true
+ default: false # CVE-2026-85260
properties_provided:
- # id, violation symptom, indicative severity tier
+ # id, violation symptom, indicative severity tier (the range published at
the advisory index since 2015)
- id: no_untrusted_code_execution
symptom: "deserialization gadget / bean-method-command dispatch /
expression eval not requested by route / splice into external-process argv"
- severity: critical
+ severity: medium_to_high
- id: no_untrusted_endpoint_redirect
- symptom: "wire-injected control header changes dispatch target, operation,
or transport+credentials - inside the namespace (CamelBeanMethodName,
CamelHttpUri, ...) or outside it (websocket.connectionKey, gridfs.*,
irc.sendTo, operationName, mail.smtp.*)"
- severity: critical
+ symptom: "wire-injected control header changes dispatch target, operation,
saga, or transport+credentials - inside the namespace (CamelBeanMethodName,
CamelHttpUri, ...) or outside it (websocket.connectionKey, gridfs.*,
irc.sendTo, operationName, mail.smtp.*, Long-Running-Action)"
+ severity: medium_to_high
- id: no_arbitrary_deserialization
symptom: "attacker-chosen types instantiated via
ObjectInputStream/XStream/Hessian/polymorphic-Jackson without filter"
- severity: critical_when_gadget_reachable
+ severity: medium_to_high
- id: no_external_resource_resolution_on_parse
symptom: "XML/XSLT/XSD/XPath parse of attacker input reads file / SSRF /
fetches remote DTD/stylesheet"
- severity: high
+ severity: medium_to_high
+ - id: no_untrusted_destination_or_credential_forwarding
+ symptom: "message body read as URL/path; peer-supplied address used as
outbound destination; redirect carries the endpoint's credentials to a host the
server chose"
+ severity: medium_to_high
- id: no_path_escape
- symptom: "file/mail/ftp/object-store path escapes configured root via ../
or absolute name, whether supplied in a header or reported back by the remote
store"
- severity: high
+ symptom: "file/mail/ftp/object-store path escapes configured root via ../
or absolute name, whether supplied in a header or reported back by the remote
store - incl. remote retrieve/delete/rename outside the polled directory from a
listing name"
+ severity: medium_to_high
- id: auth_components_enforce
- symptom: "request served without valid token / unvalidated
issuer-audience-signature / uncovered subpath / check silently skipped because
its option was unset / authorization computed from a differently-normalized
value than dispatch"
- severity: critical
- - id: no_secret_or_state_disclosure
- symptom: "secrets/bodies/config reach a log (INFO/WARN/ERROR), event,
world-readable file, or HTTP response"
+ symptom: "request served without valid token / unvalidated
issuer-audience-signature / uncovered subpath / check skipped because its
option was unset or its claim absent / failed check did not stop the exchange /
authentication an earlier exchange left on the thread reused / authorization
computed from a differently-normalized value than dispatch"
severity: medium_to_high
+ - id: integrity_and_required_signature_verification_fail_closed
+ symptom: "message accepted as unmodified, or as signed when a signature is
required, though the check was skipped (sender-chosen format) or ran over
another exchange's data"
+ severity: medium
+ - id: no_cross_exchange_data_or_authority
+ symptom: "body, signing key, token or thread-bound authentication left by
one exchange observed or used while another party's exchange is processed"
+ severity: medium
+ - id: no_secret_or_state_disclosure
+ symptom: "secrets/bodies/config reach a log (INFO/WARN/ERROR), event, file
other local accounts can read, or a response"
+ severity: low_to_medium
- id: no_backend_query_injection
symptom: "attacker alters the structure of a Cypher/XSLT-extension/etc
query Camel builds"
- severity: high_to_critical
+ severity: medium
+
+severity_calibration:
+ note: "tiers are the ranges published at the advisory index since 2015 for
the artifacts this model covers; the three Critical ratings date from 2013-2014
(CVE-2013-4330, CVE-2014-0002, CVE-2014-0003); CVE-2026-56140 was published Low
as hardening; Critical remains available for code execution or full compromise
with no precondition"
Review Comment:
Done in fd3d9918b946: the `severity_calibration` note now says the Critical
Camel K advisories on the index (CVE-2026-80351, CVE-2026-80352) are out of
this model's scope, matching the prose.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
