Apache Camel / Camel K · Disclosed

Eight Apache Camel flaws allow code execution; fixes available

Oct 26, 2026 · 1 min read

Eight flaws in Apache Camel and Camel K include two critical ones, with remote code execution via unsafe deserialization and arbitrary Kubernetes object deployment. There is no confirmed evidence of exploitation in the wild, according to Dark Web Informer. Fixes require upgrading Camel to 4.18.5, 4.22.1 or 4.23.0, and Camel K to 2.9.3, 2.10.2 or 2.11.0.

By HIFY Radar newsroom Updated 10/26/2026 01:55 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Eight security flaws were disclosed in Apache Camel and Camel K, integration frameworks used to connect systems. Two are critical, in Camel K, and allow remote code execution and arbitrary Kubernetes object deployment. The other six, high severity, allow authentication bypass and data theft, according to Dark Web Informer.

Why it matters

Systems using the affected components can suffer code execution, exposure of vault secrets and configuration values, credential theft, and local file disclosure. Exploitability depends on the components and configurations in use. There is no confirmed evidence of exploitation in the wild.

What to do

Upgrade Apache Camel to 4.18.5, 4.22.1 or 4.23.0 and Camel K to 2.9.3, 2.10.2 or 2.11.0. Check which affected components (JGroups, Spring Redis, OAuth, HTTP and Smooks) are in use across company systems.

For the technical team

Affected: Apache Camel / Camel K (componentes JGroups, Spring Redis, OAuth, HTTP e Smooks) · Apache Camel and Camel K. Cited components: JGroups, Spring Redis, OAuth, HTTP and Smooks. Specific affected versions not stated in the sources.
Exploitation: No confirmed evidence of exploitation in the wild, according to Dark Web Informer.
Fix: Apache Camel 4.18.5, 4.22.1 or 4.23.0; Camel K 2.9.3, 2.10.2 or 2.11.0.
Vector: Two critical Camel K flaws: unsafe deserialization leading to remote code execution, arbitrary Kubernetes object deployment, and code execution inside the Camel K operator pod. Six high-severity flaws in the JGroups, Spring Redis, OAuth, HTTP and Smooks components: authentication bypass after failed OAuth checks, exposure of vault secrets and configuration values, credential theft through malicious HTTP redirects, and local file disclosure through XML external entities (XXE). Exploitability depends on the components and configurations in use.
More details: Disclosure reported by Dark Web Informer, based on a project advisory. CVE identifiers not cited in the sources.