Executive brief
Apache Camel is a popular integration framework used to connect different software applications. A security flaw in its Post-Quantum Cryptography (PQC) component allows an attacker with access to the server's filesystem to execute malicious code. This could lead to a full system takeover, data theft, or disruption of business operations.
Technical details
The vulnerability exists in the `FileBasedKeyLifecycleManager` class within the `camel-pqc` component. The application uses `java.io.ObjectInputStream` to deserialize `<keyId>.key` files from a configured directory without implementing `ObjectInputFilter` or class-loading restrictions. Because the type check (casting to `java.security.KeyPair`) occurs after `readObject()` returns, an attacker can trigger malicious side effects during the deserialization process. Exploitation requires the ability to write to the key directory, which could be achieved via path traversal, misconfigured permissions, or symlink attacks. Successful exploitation results in arbitrary code execution in the context of the Java application. The issue is resolved in versions 4.18.2 and 4.20.0 by migrating to PKCS#8/X.509 Base64 JSON encoding.
Affected products
- Apache Software Foundation Apache Camel PQC 4.18.0 to 4.18.1, 4.19.0
Timeline
- 2026-04-26: disclosed: Initial disclosure on oss-security mailing list
- 2026-04-27: advisory: NVD and Vendor advisory published
References
- https://repo.maven.apache.org/maven2
- https://camel.apache.org/security/CVE-2026-40048.html
- http://www.openwall.com/lists/oss-security/2026/04/26/6
- https://access.redhat.com/security/cve/CVE-2026-40048
- https://bugzilla.redhat.com/show_bug.cgi?id=2463176
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40048.json