This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit bc5facecea43ae4a6e6a42a910ed739064b24175 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Oct 12 14:52:16 2026 +0200 Added CVE-2026-78164 Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-78164.md | 27 ++++++++++++++++++++++ content/security/CVE-2026-78164.txt.asc | 41 +++++++++++++++++++++++++++++++++ 2 files changed, 68 insertions(+) diff --git a/content/security/CVE-2026-78164.md b/content/security/CVE-2026-78164.md new file mode 100644 index 00000000..94cc0bad --- /dev/null +++ b/content/security/CVE-2026-78164.md @@ -0,0 +1,27 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-78164" +date: 2026-09-07T10:00:00+02:00 +url: /security/CVE-2026-78164.html +draft: false +type: security-advisory +cve: CVE-2026-78164 +severity: HIGH +summary: "Camel HTTP producers: property placeholders were resolved on the message-supplied endpoint-URI override headers, so an unauthenticated sender able to influence those headers could have configuration values and vault secrets expanded into the outbound request and no-argument registry bean methods invoked" +description: "The Camel HTTP producer families let an inbound message override the endpoint URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that message-supplied string through CamelContext.resolvePropertyPlaceholders() before using it. Property-placeholder resolution is a configuration-resolution facility, not a URI-parsing step: it reaches operating-system environment variables, JVM system properties, every PropertiesFunction registered on the classpath - inc [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immedi [...] +credit: "This issue was reported by [email protected]" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24418 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25571 (commit ba5aced7f6a1c38a963020575676ad4c76b492cf) and backported to camel-4.22.x in https://github.com/apache/camel/pull/26033 (commit 9f8a185e315ce9e120889c4106be3dbf4688e507) and to camel-4.18.x in https://github.com/apache/camel/pull/26034 (commit 7cec534c66969015d85e56631143174dd150ed94). + +The fix removes the per-message call to resolvePropertyPlaceholders() at every affected site, so a {{...}} token that appears only in CamelHttpUri or CamelRestHttpUri is now treated as a literal part of the URI. Placeholders written in the route's own endpoint URI are unaffected: those are resolved once, at build time, when the endpoint is created, which is where the contract documented for toD and enrich in the 4.22 upgrade guide already placed them. Because the value carried by these h [...] + +The camel-4.18.x backport additionally removes a site that does not exist on main: VertxHttpHelper.resolveQueryString() on that branch also resolved placeholders on the CamelHttpUri header value, so a straight cherry-pick would have left the defect reachable on the maintenance line. + +The issue is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), with the resulting exposure of configuration values corresponding to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It belongs to the same family as the property-placeholder alignment performed for the dynamic-URI EIPs in CAMEL-24282, and is separate from the Camel header-injection advisories, which concern consumers admitting the Camel namespace from the wi [...] + +Releases before 4.15.0 are affected as well, since the behaviour dates back to the camel-http4 and camel-netty4 components, but those release lines reached end of life before this issue was resolved and no fix will be issued for them. diff --git a/content/security/CVE-2026-78164.txt.asc b/content/security/CVE-2026-78164.txt.asc new file mode 100644 index 00000000..5f0b4087 --- /dev/null +++ b/content/security/CVE-2026-78164.txt.asc @@ -0,0 +1,41 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-78164" +date: 2026-09-07T10:00:00+02:00 +url: /security/CVE-2026-78164.html +draft: false +type: security-advisory +cve: CVE-2026-78164 +severity: HIGH +summary: "Camel HTTP producers: property placeholders were resolved on the message-supplied endpoint-URI override headers, so an unauthenticated sender able to influence those headers could have configuration values and vault secrets expanded into the outbound request and no-argument registry bean methods invoked" +description: "The Camel HTTP producer families let an inbound message override the endpoint URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that message-supplied string through CamelContext.resolvePropertyPlaceholders() before using it. Property-placeholder resolution is a configuration-resolution facility, not a URI-parsing step: it reaches operating-system environment variables, JVM system properties, every PropertiesFunction registered on the classpath - inc [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immedi [...] +credit: "This issue was reported by [email protected]" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24418 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25571 (commit ba5aced7f6a1c38a963020575676ad4c76b492cf) and backported to camel-4.22.x in https://github.com/apache/camel/pull/26033 (commit 9f8a185e315ce9e120889c4106be3dbf4688e507) and to camel-4.18.x in https://github.com/apache/camel/pull/26034 (commit 7cec534c66969015d85e56631143174dd150ed94). + +The fix removes the per-message call to resolvePropertyPlaceholders() at every affected site, so a {{...}} token that appears only in CamelHttpUri or CamelRestHttpUri is now treated as a literal part of the URI. Placeholders written in the route's own endpoint URI are unaffected: those are resolved once, at build time, when the endpoint is created, which is where the contract documented for toD and enrich in the 4.22 upgrade guide already placed them. Because the value carried by these h [...] + +The camel-4.18.x backport additionally removes a site that does not exist on main: VertxHttpHelper.resolveQueryString() on that branch also resolved placeholders on the CamelHttpUri header value, so a straight cherry-pick would have left the defect reachable on the maintenance line. + +The issue is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), with the resulting exposure of configuration values corresponding to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It belongs to the same family as the property-placeholder alignment performed for the dynamic-URI EIPs in CAMEL-24282, and is separate from the Camel header-injection advisories, which concern consumers admitting the Camel namespace from the wi [...] + +Releases before 4.15.0 are affected as well, since the behaviour dates back to the camel-http4 and camel-netty4 components, but those release lines reached end of life before this issue was resolved and no fix will be issued for them. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrM19sACgkQ406fOAL/ +QQDugwgAtkZVanCBsjE+fLgdM8cOJq6Egu2ANpHc6O7KHbkC7uZjQ2IyBx0gnceE +BqIx2bQEef5YHgNbua7T6n67YfDjIlZltY1fK5oNXN2Vvt4DEe2duiGeo6iEsrXY +EHskoMQj7UqBi1GMLjmhTrThA/rJKIrWXzi/5DXXSN5X/6Nh3SjUVeKJ157CpQzD +iOUbwf/bMLD9OywcpVTA23QAfF0Q6ZRVAtvJCK9mzVk4XF0VMJDZ+/1t5qkedFha +xpuJpsE/aVMRcakCHhc+A5bGs8d9a/mEsfnWOlNuDqgbD77yy2d6Yk0iYisMkQky +GAg2z8zeVRJ6rftggKd5nEXfrHXZbA== +=otpx +-----END PGP SIGNATURE-----
