Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or users

Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow

Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance

Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore

Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target

Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure

Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse

Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure

Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default

Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory

Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions

Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions

Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions

Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions

Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients

Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topic

Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache

Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching

Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header

Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim

Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set