A failure in the Apache Camel Knative HTTP consumer results in an unmuted exception being written back to the caller. The exception payload contains the class name, message, stack trace, and potentially configuration details such as file paths or connection strings. This information can be leveraged by attackers to gain insight into the application structure, environment, and underlying services, thereby increasing the effectiveness of subsequent targeted attacks. The weakness is identified as CWE‑209, a failure to restrict log coverage and error information.

The vulnerability is present in Apache Camel releases 4.0.0 through 4.18.4 and in releases 4.19.0 through 4.22.0. Users on the 4.18.x LTS stream should upgrade to 4.18.5, users on the 4.22.x LTS stream to 4.22.1, and all users can update to the 4.23.0 version where the muteException option defaults to true and the response body is suppressed on failure.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The attack vector is likely remote through an HTTP endpoint exposed by the Knative consumer; an adversary can trigger failures by sending malformed or otherwise problematic requests and then inspect the detailed error response. Because the failure message is transmitted in cleartext over the network, confidentiality is compromised and the risk circumvents basic authentication or transport encryption if not properly configured.