‹ Back to list

CVE-2026-85312

Status: Awaiting AnalysisMedium (4.8)—PoC
Severity4.8Medium · CVSS 3.1
Exploitation probability0.31 %higher than 23% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailableProof of concept on GitHub (unverified)

Improper Input Validation vulnerability in Apache Camel Core component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer header filters block, and an external sender could supply it on an inbound message. That let the sender name the saga the exchange joined, attaching their request to a long-running action started by someone else, or causing compensation to be associated with an action they did not initiate. The header is only consulted by a saga service that uses it, which bounds the exposure to deployments running sagas over an LRA coordinator.

Read full descriptionShow less

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The header is now consulted only for a saga service that actually uses it, rather than on every exchange. For deployments that cannot upgrade immediately, strip the header at the trust boundary with removeHeaders("Long-Running-Action") on every consumer that accepts messages from an untrusted sender.

CVSS

Base score
4.8
Version
3.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.31 %
Percentile among all scored CVEs
23
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector AV:N/PR:N/UI:N permite explotar sin autenticación una cabecera no filtrada en mensajes entrantes; el atacante asocia peticiones a sagas ajenas, lo que altera datos de transacciones.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Network SegmentationVulnerability ScanningRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageLimit Access to Resource Over Network

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Apache — CamelAI

CWEs

References

Show 5 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-85312",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-85312",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-19T14:33:54.394645Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@apache.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Camel",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.18.5",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "4.19.0",
              "lessThan": "4.22.1",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "4.18.5",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "4.22.1",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "4.23.0",
              "versionType": "maven"
            }
          ],
          "packageURL": "pkg:maven/org.apache.camel/camel-core",
          "packageName": "org.apache.camel:camel-core",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-19T11:17:24.427",
  "references": [
    {
      "url": "https://camel.apache.org/security/CVE-2026-85312.html",
      "source": "security@apache.org"
    },
    {
      "url": "https://github.com/apache/camel/pull/25828",
      "source": "security@apache.org"
    },
    {
      "url": "https://github.com/apache/camel/pull/25940",
      "source": "security@apache.org"
    },
    {
      "url": "https://github.com/apache/camel/pull/25942",
      "source": "security@apache.org"
    },
    {
      "url": "https://issues.apache.org/jira/browse/CAMEL-24449",
      "source": "security@apache.org"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Input Validation vulnerability in Apache Camel Core component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer header filters block, and an external sender could supply it on an inbound message. That let the sender name the saga the exchange joined, attaching their request to a long-running action started by someone else, or causing compensation to be associated with an action they did not initiate. The header is only consulted by a saga service that uses it, which bounds the exposure to deployments running sagas over an LRA coordinator.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The header is now consulted only for a saga service that actually uses it, rather than on every exchange. For deployments that cannot upgrade immediately, strip the header at the trust boundary with removeHeaders(\"Long-Running-Action\") on every consumer that accepts messages from an untrusted sender."
    }
  ],
  "lastModified": "2026-10-19T20:45:51.597",
  "sourceIdentifier": "security@apache.org"
}