The ConsulRegistry component in Apache Camel reads Java‑serialized objects directly from a Consul KV store and forwards the data to ObjectInputStream.readObject() without applying an ObjectInputFilter. This allows an attacker who can inject a malicious serialized object into the store to have it automatically deserialized during a Camel lookup, resulting in arbitrary code execution within the Camel process. The vulnerability is categorized as CWE‑502, unsafe deserialization, which can compromise confidentiality, integrity, and availability of the affected system.

Apache Camel’s camel‑consul component is affected. The flaw exists in versions 3.0.0 up to 4.18.x before the corresponding patch releases: all 3.x and 4.0‑4.14.x prior to 4.14.6 and 4.15.0‑4.18.x prior to 4.18.1.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% indicates a low current likelihood of exploitation. The vulnerability is not listed in CISA KEV, showing no widespread public exploitation yet. An attacker needs the ability to write to the Consul KV store that backs the Camel ConsulRegistry; with that privilege the attacker can insert a crafted serialized payload that will be executed automatically the next time Camel performs a lookup.