An error in Apache Camel’s gRPC component causes the message of a failing route’s exception to be copied into the gRPC status description that is transmitted to the client. The exposed description can reveal internal exception details such as class and package names, file paths, host names, and connection parameters, allowing an attacker to gather sensitive information about the server environment. This flaw is a classic information‑disclosure weakness described by CWE‑209.

Apache Camel products with gRPC support from version 4.0.0 up to but not including 4.18.5, and from 4.19.0 up to but not including 4.22.1 are vulnerable. The long‑term support streams 4.18.x should upgrade to 4.18.5, while the 4.22.x stream should move to 4.22.1. The latest release, 4.23.0, contains the fix.

The CVSS score of 5.3 indicates a moderate severity vulnerability. No EPSS score is provided, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is an external actor using a gRPC client to trigger a failure in a Camel route; the resulting status description leaks internal details, but no code execution or privilege escalation is possible. The flaw can be exploited without special conditions other than causing an error in a gRPC consumer.