Description
Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log. It defaulted to true, so a deployment that did nothing logged protected health information out of the box. Two further paths wrote payload content to the log regardless of the setting, so even an operator who had turned logPhi off was still exposed on those paths. MLLP is used to carry HL7 clinical messages, so the content concerned is patient data, and it reached ordinary application logs where it is subject to whatever retention, aggregation and access the deployment applies to logs generally rather than to clinical records.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. logPhi now defaults to false and is honoured on the paths that previously ignored it. This is a changed default: a deployment that relied on payload logging must now set logPhi=true explicitly. Because the upgrade guide for a change like this lives on the main branch only, operators upgrading within the 4.18.x or 4.22.x lines should treat this advisory as the notice of that change. For deployments that cannot upgrade immediately, set logPhi=false and be aware that two paths will continue to log payload content until the fix is applied; restrict access to the logs accordingly.
Published: 2026-10-19
Score: 5.5 Medium
EPSS: n/a
KEV: No
Impact: Sensitive Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

A default setting causes the Camel MLLP component to write HL7 patient data to application logs, exposing protected health information even when the user disables the logPhi option. Two internal paths continue to log payloads regardless of that setting, creating a confidentiality breach for any system that stores or archives logs.

Affected Systems

Apache Camel MLLP component in the Apache Software Foundation’s Camel library, affecting releases from 4.0.0 up to but excluding 4.18.5, and from 4.19.0 up to but excluding 4.22.1.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is unauthorized or compromised access to log files, which could allow an attacker or insider to read PHI. Because the data lands in ordinary application logs, it may be retained, aggregated, and accessed according to generic log‑management practices rather than stricter clinical records controls.

Generated by OpenCVE AI on October 19, 2026 at 12:27 UTC.

Remediation

Vendor Solution

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. logPhi now defaults to false and is honoured on the paths that previously ignored it. This is a changed default: a deployment that relied on payload logging must now set logPhi=true explicitly. Because the upgrade guide for a change like this lives on the main branch only, operators upgrading within the 4.18.x or 4.22.x lines should treat this advisory as the notice of that change.

Vendor Workaround

For deployments that cannot upgrade immediately, set logPhi=false and be aware that two paths will continue to log payload content until the fix is applied; restrict access to the logs accordingly.

OpenCVE Recommended Actions

  • Upgrade to Apache Camel 4.23.0; if on the 4.18.x LTS line upgrade to 4.18.5; if on the 4.22.x LTS line upgrade to 4.22.1.
  • If an upgrade cannot be applied immediately, set logPhi=false in the Camel configuration and be aware that two logging paths will still expose payload content until the fix is applied.
  • Restrict access to application logs to mitigate the risk of PHI exposure, ensuring only authorized personnel can read or retrieve those logs.

Generated by OpenCVE AI on October 19, 2026 at 12:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log. It defaulted to true, so a deployment that did nothing logged protected health information out of the box. Two further paths wrote payload content to the log regardless of the setting, so even an operator who had turned logPhi off was still exposed on those paths. MLLP is used to carry HL7 clinical messages, so the content concerned is patient data, and it reached ordinary application logs where it is subject to whatever retention, aggregation and access the deployment applies to logs generally rather than to clinical records. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. logPhi now defaults to false and is honoured on the paths that previously ignored it. This is a changed default: a deployment that relied on payload logging must now set logPhi=true explicitly. Because the upgrade guide for a change like this lives on the main branch only, operators upgrading within the 4.18.x or 4.22.x lines should treat this advisory as the notice of that change. For deployments that cannot upgrade immediately, set logPhi=false and be aware that two paths will continue to log payload content until the fix is applied; restrict access to the logs accordingly.
Title Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default
Weaknesses CWE-532
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-19T10:37:42.980Z

Reserved: 2026-09-03T16:35:42.561Z

Link: CVE-2026-85260

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T11:17:23.840

Modified: 2026-10-19T11:17:23.840

Link: CVE-2026-85260

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:30:14Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File