Severity:
CVSS 3.1: 6.5 (medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-platform-http-vertx) 4.0.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-platform-http-vertx) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-platform-http-vertx) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-platform-http-vertx) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-platform-http-vertx) 4.23.0 unaffected
Description:
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache
Camel Platform HTTP Vertx component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before
4.22.1.
createCorsHandler() set Access-Control-Allow-Credentials: true outside the
origin check, so the header went out on every response to a request carrying an
Origin header, including responses to origins the handler had just decided not
to allow. When camel.server.cors.origins is unset, the handler treats every
origin as allowed and echoes the caller's own Origin back as
Access-Control-Allow-Origin. Together those produce the credentialed any-origin
configuration that the fetch specification refuses to express as a literal
wildcard, which is precisely why reflecting the origin is the usual way around
that rule. A page on any origin could therefore make credentialed cross-origin
requests to the Camel endpoint and read the responses.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent
only when the request origin matched an origin the operator actually
configured. With no origin list the origin is still reflected, as before, but
credentials are not granted, and Vary: Origin is now set whenever the origin is
reflected so that a shared cache cannot serve one origin's response to another.
For deployments that cannot upgrade immediately, set camel.server.cors.origins
to the explicit list of origins that need access rather than leaving it unset.
Solution:
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent
only when the request origin matched an origin the operator actually
configured. With no origin list the origin is still reflected, as before, but
credentials are not granted, and Vary: Origin is now set whenever the origin is
reflected so that a shared cache cannot serve one origin's response to another.
Work Arounds:
For deployments that cannot upgrade immediately, set camel.server.cors.origins
to the explicit list of origins that need access rather than leaving it unset.
Credit:
Claude Security (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-84176.html
https://issues.apache.org/jira/browse/CAMEL-24436
https://github.com/apache/camel/pull/25820
https://github.com/apache/camel/pull/25937
https://github.com/apache/camel/pull/25938
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-84176
