CVE-2026-40858
Insecure Deserialization in Apache Camel Infinispan Causes RCE
Publication date: 2026-04-27
Last updated on: 2026-04-28
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | camel | 4.19.0 |
| apache | camel | From 4.15.0 (inc) to 4.18.2 (exc) |
| apache | camel | From 4.0.0 (inc) to 4.14.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network/system scanning methods provided in the available resources for CVE-2026-40858.
Detection generally involves verifying the version of the Apache Camel component camel-infinispan in use. If the version is from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, or from 4.19.0 before 4.20.0, the system is vulnerable.
To detect the vulnerability, you can check the version of Apache Camel in your environment and confirm if it falls within the affected ranges.
No direct commands for scanning or detecting exploitation attempts are provided.
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary code execution within the context of the affected Camel application.
If an attacker can write to the Infinispan cache used by the application, they can inject malicious serialized objects that execute code when deserialized.
This could allow attackers to take control of the application, potentially leading to data breaches, service disruption, or further compromise of the system.
Can you explain this vulnerability to me?
The CVE-2026-40858 vulnerability affects the Apache Camel component camel-infinispan, specifically its ProtoStream-based remote aggregation repository.
The issue arises because the repository deserializes data from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter, leading to unsafe deserialization.
An attacker who has write access to the Infinispan cache can inject a malicious serialized Java object. When this object is deserialized during normal operations such as get or recover, it can trigger arbitrary code execution within the context of the Camel application.
Affected versions include Apache Camel from 4.0.0 up to but not including 4.14.7, from 4.15.0 up to but not including 4.18.2, and from 4.19.0 up to but not including 4.20.0.
The vulnerability has been fixed in versions 4.14.7, 4.18.2, and 4.20.0.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-40858 vulnerability, users should upgrade their Apache Camel installations to the fixed versions that address this issue.
- Upgrade to version 4.14.7 if you are using the 4.14.x LTS release stream.
- Upgrade to version 4.18.2 if you are using the 4.18.x release stream.
- Upgrade to version 4.20.0 if you are using newer versions beyond 4.19.x.
These upgrades fix the unsafe deserialization issue in the camel-infinispan component's ProtoStream-based remote aggregation repository, preventing arbitrary code execution.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker with write access to the Infinispan cache to execute arbitrary code within the context of the Apache Camel application. This could potentially lead to unauthorized access, data manipulation, or data breaches.
Such security weaknesses can impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure processing environments to prevent unauthorized access and data breaches.
Therefore, if exploited, this vulnerability could undermine the confidentiality and integrity of data handled by the affected application, potentially leading to non-compliance with these regulations.
Users are strongly advised to upgrade to fixed versions to mitigate this risk and maintain compliance.