Description
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.




createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another. For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.
Published: 2026-10-19
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Credential Leakage via Improper CORS Origin Handling
Action: Immediate Patch
AI Analysis

Impact

The vulnerability causes every HTTP response from the Camel Platform HTTP Vertx component to send Access‑Control‑Allow‑Credentials:true regardless of the incoming Origin header and, when no origin list is configured, the component reflects the caller’s Origin back as Access‑Control‑Allow‑Origin. This combination allows a page at any origin to perform credentialed cross‑origin requests to the Camel endpoint and read the responses, exposing data that should be protected. The weakness is a case of improper CORS configuration (CWE‑942).

Affected Systems

Apache Camel from the Apache Software Foundation. Versions affected are 4.0.0 up through, but not including, 4.18.5, and 4.19.0 up through, but not including, 4.22.1. Users on the 4.18.x LTS stream should upgrade to 4.18.5, and those on 4.22.x LTS should upgrade to 4.22.1, while the latest non‑LTS 4.23.0 contains the fix.

Risk and Exploitability

The CVSS score is 6.5, indicating a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting the probability of exploitation is currently unknown. Attackers can trigger the flaw simply by sending an HTTP request with an Origin header from any malicious origin; no special authentication or privileged access is required. Given the straightforward request pattern, the risk remains moderate but significant, especially if the application handles sensitive data.

Generated by OpenCVE AI on October 19, 2026 at 11:39 UTC.

Remediation

Vendor Solution

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another.

Vendor Workaround

For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.

OpenCVE Recommended Actions

  • Upgrade Apache Camel to version 4.23.0; upgrade 4.18.x LTS streams to 4.18.5 and 4.22.x LTS streams to 4.22.1.
  • If an upgrade cannot be performed immediately, configure the camel.server.cors.origins property to an explicit list of approved origins, ensuring Access‑Control‑Allow‑Credentials is only sent for those origins.
  • Use a reverse proxy or WAF to enforce strict Origin checks and remove or block any requests that do not match the configured CORS policy.

Generated by OpenCVE AI on October 19, 2026 at 11:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apache Camel
Apache camel
Vendors & Products Apache
Apache apache Camel
Apache camel

Mon, 19 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another. For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.
Title Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection
Weaknesses CWE-942
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Subscriptions

Apache Apache Camel Camel
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-19T10:30:00.854Z

Reserved: 2026-09-01T09:24:51.254Z

Link: CVE-2026-84176

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T11:17:21.750

Modified: 2026-10-19T11:17:21.750

Link: CVE-2026-84176

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:30:13Z

Weaknesses
  • CWE-942

    Permissive Cross-domain Security Policy with Untrusted Domains