‹ Back to list

CVE-2026-85313

Status: Awaiting AnalysisMedium (4.3)—PoC
Severity4.3Medium · CVSS 3.1
Exploitation probability0.34 %higher than 26% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailableProof of concept on GitHub (unverified)

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the platform-http-vertx advisory published alongside it, in a different component.

Read full descriptionShow less

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly. For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relying on what enableCORS installs, naming the allowed origins.

CVSS

Base score
4.3
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.34 %
Percentile among all scored CVEs
26
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector AV:N/PR:N/UI:R exige interacción del usuario; enableCORS instala un filtro que acepta cualquier origen con credenciales, permitiendo leer respuestas desde páginas ajenas.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Application Isolation and SandboxingExploit ProtectionUpdate SoftwareData Loss Prevention

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Apache — CamelAI

CWEs

References

Show 5 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-85313",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-85313",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-19T14:33:15.618494Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@apache.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Camel",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.18.5",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "4.19.0",
              "lessThan": "4.22.1",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "4.18.5",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "4.22.1",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "4.23.0",
              "versionType": "maven"
            }
          ],
          "packageURL": "pkg:maven/org.apache.camel/camel-jetty",
          "packageName": "org.apache.camel:camel-jetty",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-19T11:17:24.560",
  "references": [
    {
      "url": "https://camel.apache.org/security/CVE-2026-85313.html",
      "source": "security@apache.org"
    },
    {
      "url": "https://github.com/apache/camel/pull/25829",
      "source": "security@apache.org"
    },
    {
      "url": "https://github.com/apache/camel/pull/25937",
      "source": "security@apache.org"
    },
    {
      "url": "https://github.com/apache/camel/pull/25938",
      "source": "security@apache.org"
    },
    {
      "url": "https://issues.apache.org/jira/browse/CAMEL-24450",
      "source": "security@apache.org"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nSetting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the platform-http-vertx advisory published alongside it, in a different component.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly. For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relying on what enableCORS installs, naming the allowed origins."
    }
  ],
  "lastModified": "2026-10-19T20:45:51.597",
  "sourceIdentifier": "security@apache.org"
}