CVE-2026-40048: Apache Camel PQC unsafe deserialization in FileBasedKeyLifecycleManager

CVE-2026-40048 · Severity: high · CVSS 7.8 · Published 2026-04-27

Apache Camel is a popular integration framework used to connect different software applications. A security flaw in its Post-Quantum Cryptography (PQC) component allows an attacker with access to the server's filesystem to execute malicious code. This could lead to a full system takeover, data theft, or disruption of business operations.

Technologies: org.apache.camel:camel-pqc (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-40048 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40048 being exploited in the wild.
How severe is CVE-2026-40048?
High severity, with a CVSS score of 7.8, published 27 April 2026.
Which products and versions are affected?
Apache Software Foundation Camel PQC 4.18.0 to 4.18.1, 4.19.0; org.apache.camel:camel-pqc (Maven) < 4.18.2, ECOSYSTEM:introduced=0,fixed=4.18.2.
Is there a fix for CVE-2026-40048?
Yes. org.apache.camel:camel-pqc (Maven): upgrade to 4.18.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40048 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-40048?
Check whether you run Apache Software Foundation Camel PQC or org.apache.camel:camel-pqc (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-pqc (Maven): upgrade to 4.18.2 or later
    # set org.apache.camel:camel-pqc to 4.18.2 in your pom.xml or build.gradle

Technical details

The vulnerability exists in the `FileBasedKeyLifecycleManager` class within the `camel-pqc` component. The application uses `java.io.ObjectInputStream` to deserialize `<keyId>.key` files from a configured directory without implementing `ObjectInputFilter` or class-loading restrictions. Because the type check (casting to `java.security.KeyPair`) occurs after `readObject()` returns, an attacker can trigger malicious side effects during the deserialization process. Exploitation requires the ability to write to the key directory, which could be achieved via path traversal, misconfigured permissions, or symlink attacks. Successful exploitation results in arbitrary code execution in the context of the Java application. The issue is resolved in versions 4.18.2 and 4.20.0 by migrating to PKCS#8/X.509 Base64 JSON encoding.

Affected products

  • Apache Software Foundation Apache Camel PQC 4.18.0 to 4.18.1, 4.19.0

Identifiers

  • CVE-2026-40048
  • GHSA-v3vg-332r-mw99

Timeline

  • 2026-04-26: disclosed: Initial disclosure on oss-security mailing list
  • 2026-04-27: advisory: NVD and Vendor advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.