Description
Incorrect Default Permissions vulnerability in Apache Camel PQC component.

This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.

When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than restricting the file to its owner. On a host whose umask allows group or world read, the private key was therefore readable by other local accounts. The exposure is to a local party rather than to the remote sender that the Camel threat model treats as the primary adversary, which is why the severity is assessed low, but the consequence where it applies is complete: possession of the private key defeats every signature and key exchange the deployment performs with it.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Key material is now written with owner-only permissions. For deployments that cannot upgrade immediately, place the key directory on a path only the service account can traverse, and tighten the process umask. Key material already written with permissive permissions should be treated as exposed and rotated.
Published: 2026-10-19
Score: 5.5 Medium
EPSS: n/a
KEV: No
Impact: Local Private Key Exposure
Action: Patch Now
AI Analysis

Impact

The Apache Camel PQC component wrote generated key material to disk using the process’s default umask, which left the files readable by group or world on hosts whose umask permits such access. This behavior exposed the private key to any local account on the system. Possession of the private key enables an attacker to forge signatures and break key exchanges performed by the application. The impact is limited to local adversaries, but the consequence is complete once the key is compromised.

Affected Systems

The flaw affects Apache Camel from version 4.12.0 through 4.18.4 and from 4.19.0 through 4.22.0. It is resolved in Camel 4.18.5, 4.22.1, and 4.23.0, all distributed by the Apache Software Foundation.

Risk and Exploitability

With a CVSS score of 5.5, this weakness presents moderate risk. No EPSS score is available and the vulnerability is not listed in CISA KEV. An attacker with local or privileged access can read the key files if the server’s umask allows group or world visibility, enabling local compromise. The risk is heightened on poorly secured hosts that rely on default permissions.

Generated by OpenCVE AI on October 19, 2026 at 12:25 UTC.

Remediation

Vendor Solution

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Key material is now written with owner-only permissions.

Vendor Workaround

For deployments that cannot upgrade immediately, place the key directory on a path only the service account can traverse, and tighten the process umask. Key material already written with permissive permissions should be treated as exposed and rotated.

OpenCVE Recommended Actions

  • Upgrade Apache Camel to version 4.18.5, 4.22.1, or 4.23.0, which writes key material with owner‑only permissions.
  • If upgrading is delayed, relocate the key directory to a path accessible only by the service account and set a restrictive umask to prevent group or world read.
  • Invalidate any key material already written with permissive permissions and generate fresh keys.

Generated by OpenCVE AI on October 19, 2026 at 12:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than restricting the file to its owner. On a host whose umask allows group or world read, the private key was therefore readable by other local accounts. The exposure is to a local party rather than to the remote sender that the Camel threat model treats as the primary adversary, which is why the severity is assessed low, but the consequence where it applies is complete: possession of the private key defeats every signature and key exchange the deployment performs with it. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Key material is now written with owner-only permissions. For deployments that cannot upgrade immediately, place the key directory on a path only the service account can traverse, and tighten the process umask. Key material already written with permissive permissions should be treated as exposed and rotated.
Title Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions
Weaknesses CWE-276
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-19T14:35:02.757Z

Reserved: 2026-09-03T16:39:46.231Z

Link: CVE-2026-85300

cve-icon Vulnrichment

Updated: 2026-10-19T14:34:39.209Z

cve-icon NVD

Status : Received

Published: 2026-10-19T11:17:24.147

Modified: 2026-10-19T15:17:07.440

Link: CVE-2026-85300

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:30:14Z

Weaknesses
  • CWE-276

    Incorrect Default Permissions