CVE-2026-85257
Received Received - Intake

Information Disclosure in Apache Camel CXF Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, the exception was described back to the SOAP client in the fault: CXF copies the message into the SOAP faultstring, and can be configured to place the stack trace in the fault detail. An external caller able to provoke a failure could therefore read internal detail about the deployment - class and package names, and whatever the exception message carries. Declared faults, annotated @WebFault, are a different matter: those are part of the published contract that clients are written against, and suppressing them would break the service rather than protect anything. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. A muteException consumer option, defaulting to true, replaces an undeclared route failure with a generic fault carrying no class name, message or stack trace. Faults the contract declares are reported exactly as before. Set muteException=false to restore the previous output. For deployments that cannot upgrade immediately, declare the exceptions the service is allowed to report and map every other failure onto one of them in an onException handler, so no undeclared exception reaches the fault.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85257
EUVD
EUVD-2026-104195

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85257 is an information disclosure vulnerability in Apache Camel's Camel-CXF component. When a route behind a CXF SOAP consumer fails with an undeclared exception, sensitive details like internal class names, package names, and exception messages are exposed to the SOAP client in the fault response. This happens because CXF copies exception details into the SOAP faultstring and may include stack traces.

The vulnerability occurs only for exceptions not declared in the service contract. Declared faults, marked with @WebFault, are part of the published contract and are not affected. The issue is classified as CWE-209 and has a medium severity rating with a CVSS score of 5.3.

Detection Guidance

To detect this vulnerability, check Apache Camel CXF component versions. Run: 'camel-cxf --version' or inspect your dependency management files (Maven/Gradle) for versions between 4.0.0 and 4.18.4, or 4.19.0 and 4.22.0. Monitor SOAP fault responses for exposed internal details like class names or stack traces during route failures.

Impact Analysis

An attacker could exploit this vulnerability to gain internal details about the deployment, such as class and package names, which may help in further attacks. The exposed exception messages might also reveal sensitive application data or configuration details.

The impact is limited to information disclosure; no direct code execution or data modification is possible. However, the leaked information could be used for reconnaissance or to craft more targeted attacks against the system.

Compliance Impact

This vulnerability may violate compliance requirements that mandate protection of sensitive data, such as personally identifiable information (PII) or protected health information (PHI). Exposing internal exception details could be considered a breach of confidentiality under GDPR or HIPAA if such data is inadvertently disclosed.

Organizations must ensure that exception handling does not expose sensitive information to comply with data protection regulations. Upgrading to patched versions or configuring the muteException option to true helps mitigate this risk and maintain compliance.

Mitigation Strategies

Upgrade Apache Camel to 4.23.0, or to 4.18.5 (4.18.x LTS), or to 4.22.1 (4.22.x LTS). Alternatively, set muteException=true in CXF consumer configuration to suppress sensitive details in faults. For immediate mitigation without upgrade, declare exceptions in service contracts or use onException handlers to map undeclared failures to generic faults.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart