Deserialization of Untrusted Data in Apache Camel PQC Component

Executive Summary

CVE-2026-43867 is a medium-severity security vulnerability in the Apache Camel camel-pqc component. It involves insecure deserialization of key metadata stored in AWS Secrets Manager. Specifically, the AwsSecretsManagerKeyLifecycleManager reads serialized key metadata using java.io.ObjectInputStream.readObject() without applying any ObjectInputFilter or class allow-list. This means that if an attacker has write access to the AWS Secrets Manager secret (requiring secretsmanager:PutSecretValue permission), they can store a crafted serialized object that will be deserialized during normal key lifecycle operations. Because the deserialization happens before type checks, this can lead to arbitrary code execution within the application managing the keys.

The vulnerability affects Apache Camel versions from 4.18.0 before 4.18.3 and from 4.19.0 before 4.21.0. The issue is related to CWE-502 (Deserialization of Untrusted Data) and is similar to CVE-2026-46590. The fix involves upgrading to versions 4.21.0 or 4.18.3, which introduce a safer deserialization approach using JSON and an allow-list ObjectInputFilter.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can lead to arbitrary code execution within the context of the application that manages the keys. This means an attacker with write access to the AWS Secrets Manager secret could execute malicious code, potentially compromising the security and integrity of the application and its environment.

The impact depends on the attacker's ability to write to the AWS Secrets Manager secret holding the key metadata. If such access is granted, the attacker can craft serialized objects that trigger harmful side effects during deserialization, leading to unauthorized actions or control over the application.

To mitigate the impact, users should upgrade to fixed versions or restrict write permissions to the secret to only the application's own identity, following the principle of least privilege.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, users should upgrade Apache Camel to version 4.21.0 or 4.18.3 if they are on the 4.18.x LTS release stream, as these versions include the fix.

If upgrading immediately is not possible, restrict write access to the AWS Secrets Manager secret that holds the camel-pqc key metadata. Only the application’s own identity should have the secretsmanager:PutSecretValue permission on that secret, following the principle of least privilege.

Additionally, keep the PQC key material in a secret separate from any data that less-trusted principals can write to reduce risk.

Useful 0 Not Useful 0