CVE-2026-85313
Received Received - Intake

Permissive Cross-domain Policy in Apache Camel Jetty Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the platform-http-vertx advisory published alongside it, in a different component. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly. For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relying on what enableCORS installs, naming the allowed origins.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85313
EUVD
EUVD-2026-104201

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a permissive cross-domain policy in Apache Camel's Jetty component. When CORS is enabled via the enableCORS setting, Jetty's CrossOriginFilter is installed with default insecure settings that allow all origins and grant credentials. This means any website can make cross-origin requests with credentials to the endpoint and read responses, creating a security risk.

Detection Guidance

Check Apache Camel Jetty component versions with: curl -s http://your-server:port/actuator/info | grep camel. Look for endpoints using enableCORS=true without explicit origin restrictions. Review logs for CrossOriginFilter warnings about wildcard origins or credentials.

Impact Analysis

An attacker could exploit this to make unauthorized cross-origin requests with credentials to your application, potentially accessing sensitive data. The vulnerability allows credentialed requests from any origin, which violates security best practices and could lead to data breaches or unauthorized actions on behalf of users.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data protection, such as GDPR's principle of least privilege or HIPAA's safeguards for protected health information. The permissive cross-domain policy may expose sensitive data to unauthorized origins, increasing the risk of non-compliance.

Mitigation Strategies

Upgrade Apache Camel to 4.23.0 or apply patches 4.18.5/4.22.1. If immediate upgrade is impossible, disable enableCORS or manually configure CrossOriginFilter with explicit allowedOrigins and allowCredentials=false.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85313. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart