The vulnerability resides in the camel-infinispan component’s remote aggregation repository, which deserializes data from a remote Infinispan cache using java.io.ObjectInputStream without applying an ObjectInputFilter. If an attacker can write to the cache, they can inject a crafted serialized Java object that, when later read during normal aggregation operations such as get or recover, triggers arbitrary code execution in the application’s context. This flaw is classified as CWE‑502 and allows the attacker to execute code with the privileges of the Camel application.

Apache Camel versions 4.0.0 through 4.14.6, 4.15.0 through 4.18.1, and 4.19.0 through 4.19.9 are vulnerable. Versions 4.14.7, 4.18.2, and 4.20.0 contain the fix and are not affected.

The CVSS score of 8.8 indicates a high severity risk. Although the EPSS score is less than 1%, suggesting a low likelihood of exploitation at present, the possibility of malicious insiders or compromised components granting write access to the Infinispan cache cannot be ignored. The vulnerability is not listed in the CISA KEV catalog, but the potential impact remains severe. The attack vector is inferred to require write access to the Infinispan cache; once such access is achieved, the attacker can trigger code execution during routine repository operations.