Apache Camel developers have released urgent patches addressing multiple vulnerabilities, including high-severity XML External Entity (XXE) flaws and unsafe deserialization issues. These can lead to sensitive information disclosure, remote code execution, stolen credentials, and bypassed access controls.
Details of the flaws
One major problem is CVE-2026-90885 in Camel-Saxon. It arises when Apache Camel’s XQueryBuilder handles message bodies represented as javax.xml.transform.Source objects with Saxon’s default parser settings, enabling external entities declared in the XML content to be resolved—introducing an XXE risk. Another XXE issue, CVE-2026-85250 in Camel-XPath, stems from cases where documentType=InputSource leads to constructing a parser using JDK defaults that bypass restrictions imposed by default document type settings.
CVE-2026-88901 affects Camel-Smooks, where the default XML reader resolves external general and parameter entities and loads external document type definitions—also permitting reading local files or contacting internal hosts via attacker-controlled XML. Camel-FOP received a medium-severity XXE fix tied to unsafe handling in certain third-party XML transformer combinations.
On the deserialization front: CVE-2026-88900 in Camel-JGroups is an unsafe Java deserialization flaw that could permit remote attackers to execute code. Another high-severity vulnerability, CVE-2026-78165 in Camel-Spring-Redis, allows misuse of its default deserializer when an attacker can publish to a subscribed channel, enabled by the absence of an object input filter.
Credential leakage is also addressed. Camel-HTTP has CVE-2026-85251: when followRedirects is enabled, the Authorization header is preserved across redirects, potentially sending credentials to unintended external destinations. Additional patches tackle OAuth bypasses and issues in Keycloak token validation.
What users should do
Updates are now available in the patched releases listed in Apache’s advisories. For the Saxon issue, secure versions include 4.18.5, 4.22.2, and 4.23.0. The XPath and Smooks fixes are in 4.18.5, 4.22.1, and 4.23.0. Users are urged to review their Camel components, deployed XML processing paths, message entry points, and redirect settings when planning upgrades.
Because many Camel applications bundle multiple libraries or components, it’s critical to verify version ranges for each module rather than assuming one upgrade covers all vulnerabilities. Teams should also consider how messages reach vulnerable code paths—often only when specific components are used or attacker-controlled content is processed in certain ways.
Note that these issues are distinct from past Camel or Tomcat vulns already covered in earlier reports; there is no indication yet that these newly listed flaws are being exploited in attacks.
These patches matter because Camel is widely used for integration, data routing, and message processing. Exposed XML parsers and deserializers are frequent points of insecurity in modern distributed and service-oriented architectures. Organizations relying on Camel should audit their XML entry points, ensure proper configuration and filtering, and apply these updates swiftly to limit risk vectors—especially for high-severity defects. Monitoring vendor advisories and threat intelligence will be essential to avoid blind spots in this complex ecosystem.
