oscerd opened a new pull request, #25699: URL: https://github.com/apache/camel/pull/25699
## What this is A reconciliation of `docs/user-manual/modules/ROOT/pages/security-model.adoc` with the advisories published since the last refresh (#25054, July). Twenty-five published 2026 CVEs were not reflected in the model. Rather than appending IDs to the existing class lists, this captures the **eight places where an advisory showed the model was wrong or too narrow** — cases where a triager following the current text would have closed a real finding. The rest are already covered by an existing class and are left as-is; the model states its CVE references are representative, not exhaustive. ## The eight changes **1. Three new untrusted-input sources.** The adversary model only covered "a message arriving on a transport a consumer reads", so nothing placed these inside it: names and metadata a remote store reports back (CVE-2026-66906, CVE-2026-60093, CVE-2026-66907 — remote object names traversing out of the configured download directory); LLM output including tool-call field names and arguments (CVE-2026-49042); and transport metadata that is not a message header (CVE-2026-55993). Adds a Roles row for the far side of a component — trusted to *hold* the route's data, untrusted for what it *returns* — and scopes the aggregation-repository limitation to state the route itself wrote, so it no longer reads as covering names other principals put in the store. **2. Control headers vs semantic headers.** The model drew a single line: `Camel*` is the framework's job, everything else is route-author responsibility. That discharges reports it should not — `websocket.connectionKey`, `gridfs.*`, `irc.sendTo`, `operationName`, `mail.smtp.*` are all outside the namespace and all steer the exchange. New rule: **a header that selects a target, an operation, or the transport and its credentials is a control header however it is spelled**, and filtering it is the framework's job (CVE-2026-71300, CVE-2026-48204, CVE-2026-49097, CVE-2026-46592, CVE-2026-46587, CVE-2026-46588, CVE-2026-46453, CVE-2026-46584, CVE-2026-49086). Semantic headers — those a component reads as payload data — remain pass-through by contract. **3. Every inbound mapping site, not only the consumer.** Data formats (CVE-2026-59230, and CAMEL-24419 for the follow-on where the data format filtered a narrower namespace than its sibling consumer path), structured content modes (CVE-2026-63621) and transport-metadata mapping (CVE-2026-55993) all populate the same header map. **4. "A filter that is never consulted is not a filter."** CVE-2026-78329 — the strategy was constructed and immediately overwritten, so CAMEL-23588's hardening had been inert since it shipped; and CAMEL-24412, a case-insensitive check sitting behind a case-sensitive guard. Recorded in *Known non-findings* as a reason **not** to close a report: "the component declares a `HeaderFilterStrategy`" is not evidence that it runs on the live path. **5. New in-scope class — argument injection into an external process** (CVE-2026-40047). The properties table already claimed untrusted data is never turned into executed code or OS commands, but no in-scope class carried the mechanism. **6. Two auth sub-rules, each now behind more than one advisory.** An unconfigured check must fail closed rather than silently drop out of the validation chain (CVE-2026-66908, CVE-2026-53913, CAMEL-24411); and the authorization decision must be computed from the same normalized value as dispatch (CVE-2026-40022, CAMEL-24412). **7. Deserialization.** An under-strength filter is a case in its own right (CVE-2026-42527). Records the JEP-290 filter `CamelObjectInputStream` applies by default since 4.22 (CAMEL-24296) as a floor beneath the per-component rules, and notes the indirect route through a third-party API that delegates to JDK serialization — which a grep for `new ObjectInputStream(` does not find. **8. Triage and scope.** An incomplete fix is a new finding rather than a re-opening, in three shapes: not-all-call-sites (CAMEL-24413/24420), under-strength mitigation (CVE-2026-42527), alternate route to the same sink (CVE-2026-43866, CVE-2026-46591). `VALID-HARDENING` no longer says "typically without a CVE" — CVE-2026-56140 is a hardening change that carries an advisory. And the model now states which artifacts it covers: CVE-2026-45760 is a Camel K finding whose entire mechanism (Kubernetes namespaces, operator RBAC) lives outside this page. *Known limitations*, *Known non-findings*, the disclaimed properties, the false-friend list, *Deployment hardening* and the component-author guidance are updated to follow, and `security-model.yaml` is regenerated to match. ## Verification - Every CVE cited was confirmed live on https://camel.apache.org/security/ before being written into a public page. Nothing unpublished is referenced. - Component and option names spot-checked against the tree (`camel-mongodb-gridfs`, `jwtIssuer`/`jwtAudience`, CAMEL-24296 → 4.22 upgrade guide). - `mvn -pl docs install -DskipTests` passes; table, list-continuation and open-block structure linted; no new unbalanced inline formatting; no generated-file drift. ## Note for reviewers This is a scope document — every addition is meant to be a claim the PMC is willing to defend when closing or accepting a report, not a description of code. The two most consequential are **#2** (it converts a class of reports from "route-author responsibility" to "in scope") and **#6** (it makes an unconfigured check a defect rather than a neutral default). Both are worth a hard look. --- _Claude Code on behalf of @oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
