CVE-2026-85300
Received Received - Intake

Incorrect Default Permissions in Apache Camel PQC

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than restricting the file to its owner. On a host whose umask allows group or world read, the private key was therefore readable by other local accounts. The exposure is to a local party rather than to the remote sender that the Camel threat model treats as the primary adversary, which is why the severity is assessed low, but the consequence where it applies is complete: possession of the private key defeats every signature and key exchange the deployment performs with it. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Key material is now written with owner-only permissions. For deployments that cannot upgrade immediately, place the key directory on a path only the service account can traverse, and tighten the process umask. Key material already written with permissive permissions should be treated as exposed and rotated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85300
EUVD
EUVD-2026-104199

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.12.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-276 During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Apache Camel's PQC component storing private keys with overly permissive default permissions due to the process umask. This allows other local users to read the private keys if the system's umask permits group or world access. The issue affects versions from 4.12.0 before 4.18.5 and 4.19.0 before 4.22.1.

Detection Guidance

Check file permissions of private key directories and files in Apache Camel PQC component. Use commands like 'find /path/to/keys -type f -perm -o+r -ls' to identify files readable by others. Verify umask settings with 'umask' and check if key directories are in paths restricted to the service account.

Impact Analysis

If exploited, this vulnerability allows any local user on the system to read private keys, potentially compromising all signatures and key exchanges performed by the deployment. The impact is severe as possession of the private key defeats cryptographic protections.

Mitigation Strategies

Upgrade Apache Camel to version 4.23.0, 4.22.1, or 4.18.5 depending on your release stream. If immediate upgrade is not possible, restrict key directory permissions to owner-only and tighten the process umask. Rotate any existing private keys that may have been exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85300. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart