CVE-2026-85251
Received Received - Intake

Exposure of Sensitive Information in Apache Camel HTTP Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequestInterceptorFirst, and HttpClient runs protocol-level request interceptors inside ProtocolExec, which sits below RedirectExec in the exec chain; the interceptor therefore ran again for every redirect hop and re-attached Authorization: Bearer to whatever host the Location header named. Separately, credentials were registered against an AuthScope matching any host, so basic and digest credentials were presented to a redirect target as well. A remote endpoint - or anyone who can influence its responses - could therefore collect the bearer token or the configured credentials simply by answering with a redirect to a host it controls. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Credentials are now sent only to the authority the endpoint was configured with, and are not re-attached when a redirect crosses to another host. For deployments that cannot upgrade immediately, set followRedirects=false on endpoints that carry credentials, and handle any redirect explicitly in the route so that the destination is chosen by the route rather than by the remote server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85251
EUVD
EUVD-2026-104192

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Camel's HTTP component allows sensitive credentials like OAuth2 bearer tokens or basic authentication details to be sent to unauthorized hosts during redirects. When followRedirects=true is enabled, the system re-attaches authorization headers to every redirect target, even if the new host is controlled by an attacker. This happens because the OAuth2 interceptor runs repeatedly and credentials are registered with an overly permissive host scope.

Detection Guidance

To detect this vulnerability, check Apache Camel HTTP component versions using commands like 'camel --version' or inspect dependency files (e.g., pom.xml for Maven). Look for versions between 4.0.0 and 4.18.4, 4.19.0 and 4.22.0, or 4.23.0+.

Impact Analysis

An attacker could intercept sensitive credentials by tricking the system into redirecting to a host they control. This could lead to unauthorized access to protected resources, data breaches, or account takeovers. The impact depends on the credentials exposed, ranging from session hijacking to full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations may face regulatory fines, legal liabilities, and reputational damage if credentials are leaked due to this issue.

Mitigation Strategies
  • Upgrade Apache Camel to version 4.23.0, 4.18.5 (LTS), or 4.22.1 (LTS) immediately.
  • If upgrading is not possible, set followRedirects=false on endpoints carrying credentials and handle redirects manually in the route.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85251. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart