Executive brief
Apache Camel is an open-source integration framework used to connect different applications and data sources. A security vulnerability in its Consul component allows an attacker with access to the underlying data store to execute malicious code on the server. This could lead to a full system takeover, data theft, or disruption of business operations.
Technical details
The ConsulRegistry in the Apache Camel camel-consul component fails to use an ObjectInputFilter when processing Java-serialized values from the Consul KV store. Specifically, the 'ConsulRegistryUtils.deserialize' method passes untrusted data directly to 'ObjectInputStream.readObject()'. An attacker who can write to the Consul KV store can inject a malicious serialized Java object. When Camel subsequently performs a registry lookup (e.g., via 'lookupByName'), it deserializes the object, leading to arbitrary code execution (ACE) via a gadget chain. This vulnerability is a regression or oversight following similar fixes in other Camel components.
Affected products
- Apache Software Foundation Camel 3.0.0 to 4.14.5, 4.15.0 to 4.18.0
Timeline
- 2026-04-27: disclosed
- 2026-04-27: advisory