CVE-2026-84176
Received Received - Intake

Permissive Cross-domain Policy in Apache Camel Platform HTTP Vertx

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another. For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-84176
EUVD
EUVD-2026-104211

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Camel's Platform HTTP Vertx component allows unauthorized cross-origin requests with credentials. The CORS handler incorrectly sets Access-Control-Allow-Credentials: true for all responses, even when the origin is not trusted. When no allowed origins are configured, it reflects any origin's request back as Access-Control-Allow-Origin, creating a credentialed any-origin policy. This lets any webpage make authenticated requests to the Camel endpoint and read responses.

Detection Guidance

To detect this vulnerability, check if your Apache Camel version is affected by running: 'camel-version' or checking the version in your application logs. If using Vert.x component, verify if Access-Control-Allow-Credentials is set to true without proper origin checks. Check if camel.server.cors.origins is unset in your configuration.

Impact Analysis

An attacker could exploit this to access sensitive data from your Camel application via cross-origin requests. If your application handles user credentials or sensitive information, unauthorized parties might read responses intended for other users. This could lead to data breaches, unauthorized actions, or credential theft depending on your application's functionality.

Compliance Impact

This vulnerability could violate GDPR's data protection requirements by enabling unauthorized access to personal data through cross-origin requests. For HIPAA, it may compromise protected health information by allowing credentialed access to sensitive endpoints. Both regulations require strict access controls and protection of sensitive data, which this vulnerability undermines.

Mitigation Strategies

Upgrade Apache Camel to version 4.23.0, or at least 4.18.5 for 4.18.x LTS or 4.22.1 for 4.22.x LTS. If immediate upgrade is not possible, set camel.server.cors.origins to an explicit list of allowed origins instead of leaving it unset.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84176. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart