CVE-2026-85296
Received Received - Intake

Exposure of Data Element to Wrong Session in Apache Camel

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined to the request being processed. Where a deployment serves more than one trading partner, concurrent or successive requests could therefore observe each other's material, and a Message Disposition Notification could be signed with the key of a partner other than the one the receipt was for. The result is cross-partner key confusion: a receipt attributable to the wrong partner, and one partner's signing material used while handling another partner's exchange. AS2 deployments are typically multi-partner by design, so the condition is reached by ordinary concurrent traffic rather than by anything the attacker must arrange. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Per-request signing keys are now confined to the request being processed in ResponseMDN. For deployments that cannot upgrade immediately, run a separate Camel context per trading partner so that no signing material is shared between them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85296
EUVD
EUVD-2026-104197

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-488 The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Exposure of Data Element to Wrong Session issue in the Apache Camel AS2 component. It occurs because signing material for individual requests is stored in a shared state across requests instead of being confined to the specific request. This allows concurrent or successive requests to observe each other's material, leading to cross-partner key confusion where a receipt may be attributed to the wrong partner.

Detection Guidance

This vulnerability is specific to Apache Camel AS2 component versions 4.0.0 to 4.18.4 and 4.19.0 to 4.22.0. Detection involves checking the installed version of Apache Camel. Use commands like 'camel --version' or inspect the version in your application logs or dependency files (e.g., pom.xml for Maven projects).

Additionally, monitor for unusual cross-partner key confusion events or mismatched signing keys in AS2 Message Disposition Notifications (MDNs).

Impact Analysis

If you use Apache Camel AS2 component versions 4.0.0 to 4.18.4 or 4.19.0 to 4.22.0, this vulnerability could allow unauthorized access to signing material from other trading partners. This may result in incorrect signing of Message Disposition Notifications, leading to misattributed receipts and potential security breaches in multi-partner AS2 deployments.

Mitigation Strategies

Upgrade Apache Camel to version 4.23.0 or apply the latest patches for your LTS stream (4.18.5 for 4.18.x or 4.22.1 for 4.22.x). If immediate upgrade is not possible, isolate AS2 deployments by running a separate Camel context per trading partner to prevent shared signing material.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85296. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart