CVE-2026-85247
Received Received - Intake

Improper Certificate Validation in Apache Camel Knative

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on without also configuring a truststore therefore obtained an encrypted connection with no peer authentication, which an attacker positioned on the network path can terminate and read. The dangerous state is reached by omission rather than by an explicit opt-in, which is what makes it a framework defect: turning TLS on should not be the thing that turns certificate validation off. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. With no truststore configured the trust options are now left unset so the JVM default trust anchors apply, the same fallback SSLContextParameters and the rest of Camel use. Trusting every certificate is now reached only by asking for it explicitly through the trust.all property, which remains available for development against a cluster with a self-signed certificate. For deployments that cannot upgrade immediately, configure a truststore explicitly wherever SSL is enabled. After upgrading, a deployment that was relying on the implicit trust-all behaviour must either configure a truststore or set the trust.all property deliberately.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85247
EUVD
EUVD-2026-104188

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper certificate validation issue in Apache Camel's Knative component. When SSL was enabled on the Knative HTTP client without configuring a truststore, the system defaulted to trusting all certificates, disabling peer authentication. This created an encrypted connection without verifying the server's identity, allowing attackers on the network path to intercept and read traffic.

Detection Guidance

Check if Apache Camel Knative is running with SSL enabled but no truststore configured. Inspect logs for connections using camel.knative.client.ssl.enabled=true without truststore.path or trust.cert.path set. Use network monitoring tools to detect unvalidated TLS handshakes.

Impact Analysis

Attackers on the network path can intercept and read encrypted traffic due to lack of certificate validation. This exposes sensitive data transmitted over SSL/TLS connections. Systems relying on implicit trust-all behavior are at risk of man-in-the-middle attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Upgrade Apache Camel to version 4.23.0, or 4.18.5 for 4.18.x LTS, or 4.22.1 for 4.22.x LTS. If upgrading is not possible, explicitly configure a truststore wherever SSL is enabled in Knative components.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85247. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart