oscerd opened a new pull request, #28088: URL: https://github.com/apache/camel/pull/28088
## What Revisits the security model (`security-model.adoc`, its `security-model.yaml` index and the summary in `AGENTS.md`) in light of the 38 advisories published on 2026-10-15 ([camel-website #1818](https://github.com/apache/camel-website/pull/1818), fixed in 4.18.5, 4.22.1 and 4.23.0). Some of their lessons were already in the model, but cited by Jira key (CAMEL-24411, CAMEL-24412, CAMEL-24413/24420, CAMEL-24419) or not cited at all, because the CVEs were not public yet. Others were not covered. ## Changes **Citations.** The Jira keys are replaced by the published CVE IDs. The rules that were added without a citation (unmuted exceptions, CORS, shared state, the HTTP/2 header case, prefix matching, redirects) now name their advisories. All 38 CVEs are cited. **Adversary model** - Remote directory listings and HTTP redirects are listed as far-side output that the attacker influences (CVE-2026-79983..79986, CVE-2026-85251). The far side is also untrusted when the service is compromised or shared, or when the protocol leaves its responses unprotected in transit (plain FTP). - Other local accounts on the host are named as a secondary adversary. They are in scope only for files Camel itself makes readable to them (CVE-2023-34442, CVE-2026-85300). - A Camel endpoint that manages a component through messages, such as `dynamic-router-control:`, is not a management surface (CVE-2026-83531). - A configuration that the project's own documentation shows counts as reasonably expected (CVE-2026-78164, CVE-2026-83531, CVE-2026-78163). **In-scope classes** - New class: integrity and signature verification that can be skipped (CVE-2026-85243, CVE-2026-85248). - "SSRF triggered by parsing" becomes "request forgery and credentials sent where the route did not choose". It now covers a message body read as a locator, a destination supplied by the peer, and a redirect (CVE-2026-78163, CVE-2026-80344, CVE-2026-85251). - Path traversal now covers the remote path that the remote-file consumers retrieve, delete and rename. - The control-header definition now covers the saga an exchange joins (CVE-2026-85312). - Mapping sites now include producers that parse a document (CVE-2026-85249). - Auth: a check whose claim is absent fails closed (CVE-2026-85301), and authentication is never inherited from a pooled thread (CVE-2026-84181; the skip was reachable with `alwaysReauthenticate=false`). - Expression injection: forwarding messages to an endpoint is not asking for their content to be evaluated (CVE-2026-83531). - XXE: `FEATURE_SECURE_PROCESSING` alone depends on the implementation (CVE-2026-91858). - Disclosure: payload content in the default logs (CVE-2026-85260) and secret files readable by other accounts (CVE-2026-85300). - Insecure defaults: a library object that Camel builds to do its own work (a serializer, a filter, a parser factory) carries Camel's defaults (CVE-2026-78165, CVE-2026-85313, CVE-2026-91858). The connection, TLS and authentication defaults of a wrapped client stay inherited posture. **Core invariants.** The dispatch invariant now covers the saga an exchange joins (CVE-2026-85312). The placeholder invariant gets its first concrete instance (CVE-2026-78164). **Severity tiers.** The "indicative severity" column said its tiers reflect how the PMC has historically scored each class. Several rows read "Critical (9.0-9.8)", but no advisory for these artifacts has been rated Critical since 2014: the three Critical ratings are CVE-2013-4330, CVE-2014-0002 and CVE-2014-0003. The column now gives, for each class, the range published since 2015. The note under the table says Critical remains available for code execution or full compromise with no precondition. **Triage aids** - New false friend: a `Camel*` header name is not a trust marker (CVE-2026-78164). - Two new "inverse error" entries under known non-findings: a message that reaches a control endpoint, and a finding that needs a third-party implementation on the class path. - The incomplete-fix rule now cites CVE-2026-78162 and CVE-2026-85314. - The per-option opt-in table adds the options introduced by the fixes. - Deployment hardening adds egress restriction, the encrypted variant of a protocol where one exists, and the umask. - Component-author guidance gets new questions on content sniffing, code taken from messages, placeholder resolution at runtime, signature verification, payload logging, secret files and third-party defaults. Two points need PMC judgement: 1. The severity recalibration changes guidance that triage tooling reads. 2. The heritage-defaults known limitation now lists `signatureVerificationOption=optional` (`camel-crypto-pgp`). CVE-2026-85243 kept that default on purpose, and the change records that position. Docs only. Rendered with Asciidoctor.js and gave no warnings (as `main`). `security-model.yaml` parses. No new `xref:` links. --- _Claude Code on behalf of @oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
