An improper certificate validation flaw in the Camel‑Knative component causes the HTTP client to accept any certificate when SSL is enabled without a truststore. This means that traffic protected by TLS can be decrypted by an attacker on the network path because the client bypasses standard peer authentication. The vulnerability arises purely from omission; turning on TLS, by default, disables certificate validation.

The issue affects Apache Camel from version 4.0.0 up to (but not including) 4.18.5, and from 4.19.0 up to (but not including) 4.22.1. It is specific to the Knative HTTP client component of Apache Camel, a framework released by the Apache Software Foundation.

The CVSS score of 5.9 indicates a moderate safety assessment. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited large‑scale exploitation. An attacker would need to position themselves on the network path between the client and the server and exploit the fact that SSL has been enabled without a configured truststore. Because certificate validation is disabled by omission, the attack surface extends to any deployment that enables SSL and neglects to configure a truststore, though the exploit would not succeed if a proper truststore were supplied.