CVE-2026-6857

Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization

View on CVE.org
Published Apr 22, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.

Analysis

AI-generated

Technical impact

The vulnerability is an unsafe deserialization flaw in Camel‑infinispan’s ProtoStream remote aggregation repository that allows a remote attacker with low privileges to send crafted data and gain arbitrary code execution. The flaw can compromise the confidentiality, integrity, and availability of the affected system, giving the attacker full control.

Affected Systems

Affected products include Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat build of Apache Camel 4 for Quarkus 3, and Red Hat build of Apache Camel for Spring Boot 4. Specific version details are not provided in the advisory.

Risk and Exploitability

The CVSS score is 7.5, indicating a high severity of remote code execution. EPSS data are not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, via network‑based communication with the Camel‑infinispan component, where an attacker sends maliciously crafted serialized data to trigger the flaw.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Apply the latest Red Hat security patch for the affected Camel‑infinispan component as released in the vendor’s errata.
  • If a patch is not yet available, upgrade to a product release that contains the fix for unsafe deserialization.
  • Disable or remove the ProtoStream remote aggregation repository in Camel configuration to eliminate the vulnerable interface.
  • Enforce strict user permissions and network segmentation to limit exposure of the Camel services.
  • Monitor logs for deserialization attempts and configure intrusion detection rules against the CVE.
  • Apply the official Red Hat workaround as provided in the advisory, noting that it may not meet all deployment criteria.

Generated by OpenCVE AI on April 22, 2026 at 19:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-xfxp-ppx7-cqrp camel-infinispan Vulnerable to Deserialization of Untrusted Data
History
Type Values Removed Values Added
First Time appeared Redhat apache Camel Quarkus
CPEs cpe:/a:redhat:apache_camel_quarkus:3.33
Vendors & Products Redhat apache Camel Quarkus
Type Values Removed Values Added
CPEs cpe:/a:redhat:apache_camel_quarkus:3.33
Vendors & Products Redhat apache Camel Quarkus
Type Values Removed Values Added
First Time appeared Redhat apache Camel Quarkus
CPEs cpe:/a:redhat:apache_camel_quarkus:3.33
Vendors & Products Redhat apache Camel Quarkus
References
Type Values Removed Values Added
First Time appeared Redhat apache Camel Spring Boot
CPEs cpe:/a:redhat:camel_spring_boot:4 cpe:/a:redhat:apache_camel_spring_boot:4.18
Vendors & Products Redhat camel Spring Boot
Redhat apache Camel Spring Boot
References
Type Values Removed Values Added
First Time appeared Redhat build Of Apache Camel For Quarkus
Redhat build Of Apache Camel For Spring Boot
Redhat fuse 7
Redhat jboss Enterprise Application Platform Expansion Pack
Vendors & Products Redhat build Of Apache Camel For Quarkus
Redhat build Of Apache Camel For Spring Boot
Redhat fuse 7
Redhat jboss Enterprise Application Platform Expansion Pack
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
Title Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization
First Time appeared Redhat
Redhat camel Quarkus
Redhat camel Spring Boot
Redhat jboss Enterprise Application Platform
Redhat jboss Fuse
Redhat jbosseapxp
Weaknesses CWE-502
CPEs cpe:/a:redhat:camel_quarkus:3
cpe:/a:redhat:camel_spring_boot:4
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat
Redhat camel Quarkus
Redhat camel Spring Boot
Redhat jboss Enterprise Application Platform
Redhat jboss Fuse
Redhat jbosseapxp
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (3)
Weaknesses
  • CWE-502

    Deserialization of Untrusted Data

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Oct 9, 2026, 3:39 PM
Reserved
Apr 22, 2026, 12:43 PM

View source JSON

Updated
Sep 14, 2026, 12:04 PM

JSON

Status
Awaiting Analysis
Published
Apr 22, 2026, 1:16 PM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

Severity
Important
Public date
Apr 13, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Apr 27, 2026, 8:21 PM

JSON