CVE-2026-85245
Received Received - Intake

Exposure of Data Element to Wrong Session in Apache Camel Thrift

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a fresh copy, and returned that shared object as the exchange body. Because the instance is shared process-wide, state written while unmarshalling one message stayed on the object and was visible to every later message that used the same type. Fields absent from a later payload retained the previous message's values, so content belonging to one sender could be read while processing another sender's message, and concurrent exchanges could observe each other's partially written state. In a deployment that serves more than one tenant or user through the same route, that is disclosure of one party's data to another. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Unmarshalling now deserializes into a copy, so each exchange gets its own instance and no state carries between messages. For deployments that cannot upgrade immediately, copy the unmarshalled body into a new instance immediately after the data format runs, and do not retain references to the returned object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85245
EUVD
EUVD-2026-104186

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-488 The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Exposure of Data Element to Wrong Session vulnerability in Apache Camel's Thrift component. It occurs because the Thrift data format unmarshals incoming data into a shared default instance of the target type instead of creating a fresh copy for each message. This shared object is reused across all exchanges, causing state from one message to persist and be visible in subsequent messages. As a result, data from one sender may be disclosed to another, especially in multi-tenant deployments.

Impact Analysis

This vulnerability can lead to unauthorized data disclosure between different users or tenants sharing the same Apache Camel route. If your deployment processes messages from multiple parties, sensitive information from one sender could be exposed to another. This may result in privacy violations, compliance breaches, or loss of confidential data.

Compliance Impact

This vulnerability can cause non-compliance with data protection regulations such as GDPR and HIPAA by enabling unauthorized data exposure between users or tenants. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. The risk of cross-tenant data leakage violates these requirements, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Apache Camel to version 4.23.0 or apply the latest patches for your LTS stream (4.18.5 for 4.18.x or 4.22.1 for 4.22.x). If immediate upgrade is not possible, copy the unmarshalled Thrift data into a new instance after processing and avoid retaining references to the returned object.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart