CVE-2026-40860: Apache Camel remote code execution via unsafe JMS deserialization

CVE-2026-40860 · Severity: critical · CVSS 9.8 · Published 2026-04-27

Apache Camel's JMS integration components (camel-jms, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6) deserialize untrusted JMS ObjectMessage payloads without validation, allowing an attacker to publish a crafted message to a queue or topic that achieves remote code execution when a suitable gadget chain is present. This affects Camel applications consuming JMS messages with the default mapJmsMessage option enabled, creating a critical remote code execution vulnerability accessible to anyone with publish access to the message broker.

Technologies: Apache Camel, org.apache.camel:camel-amqp (Maven), org.apache.camel:camel-jms (Maven), org.apache.camel:camel-sjms (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-40860 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40860 being exploited in the wild.
How severe is CVE-2026-40860?
Critical severity, with a CVSS score of 9.8, published 27 April 2026.
Which products and versions are affected?
Apache Camel 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x; org.apache.camel:camel-activemq (Maven) ECOSYSTEM:introduced=3.0.0,fixed=4.14.7; org.apache.camel:camel-activemq6 (Maven) ECOSYSTEM:introduced=3.0.0,fixed=4.14.7; org.apache.camel:camel-amqp (Maven) ECOSYSTEM:introduced=3.0.0,fixed=4.14.7; and 3 more.
Is there a fix for CVE-2026-40860?
Yes. org.apache.camel:camel-activemq (Maven): upgrade to 4.14.7 or later; org.apache.camel:camel-activemq6 (Maven): upgrade to 4.14.7 or later; org.apache.camel:camel-amqp (Maven): upgrade to 4.14.7 or later; org.apache.camel:camel-jms (Maven): upgrade to 4.14.7 or later; org.apache.camel:camel-sjms (Maven): upgrade to 4.14.7 or later; org.apache.camel:camel-sjms2 (Maven): upgrade to 4.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40860 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40860?
Check whether you run Apache Camel, org.apache.camel:camel-activemq (Maven), org.apache.camel:camel-activemq6 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-activemq (Maven): upgrade to 4.14.7 or later
    # set org.apache.camel:camel-activemq to 4.14.7 in your pom.xml or build.gradle
  • org.apache.camel:camel-activemq6 (Maven): upgrade to 4.14.7 or later
    # set org.apache.camel:camel-activemq6 to 4.14.7 in your pom.xml or build.gradle
  • org.apache.camel:camel-amqp (Maven): upgrade to 4.14.7 or later
    # set org.apache.camel:camel-amqp to 4.14.7 in your pom.xml or build.gradle
  • org.apache.camel:camel-jms (Maven): upgrade to 4.14.7 or later
    # set org.apache.camel:camel-jms to 4.14.7 in your pom.xml or build.gradle
  • org.apache.camel:camel-sjms (Maven): upgrade to 4.14.7 or later
    # set org.apache.camel:camel-sjms to 4.14.7 in your pom.xml or build.gradle
  • org.apache.camel:camel-sjms2 (Maven): upgrade to 4.14.7 or later
    # set org.apache.camel:camel-sjms2 to 4.14.7 in your pom.xml or build.gradle

Technical details

The vulnerability exists in JmsBinding.extractBodyFromJms() and equivalent classes across multiple Camel JMS components, which call javax.jms.ObjectMessage.getObject() to deserialize incoming message payloads without applying ObjectInputFilter, allowlist, or denylist controls. The vulnerable code path is reached whenever the mapJmsMessage option is enabled (the default behavior) and Camel acts as a JMS consumer. An attacker with access to publish messages to a JMS queue or topic can craft a malicious ObjectMessage payload containing a serialized gadget chain; when the Camel consumer deserializes this payload, the gadget chain executes arbitrary code with the privileges of the Camel application. The vulnerability affects camel-jms, camel-sjms, camel-sjms2, and camel-amqp directly, and transitively impacts camel-activemq and camel-activemq6. Patches are available in versions 4.14.7, 4.18.2, and 4.20.0.

Affected products

  • Apache Camel JMS 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
  • Apache Camel SJMS 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
  • Apache Camel SJMS2 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
  • Apache Camel AMQP 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
  • Apache Camel ActiveMQ 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x
  • Apache Camel ActiveMQ6 3.0.0 to 4.14.6, 4.15.0 to 4.18.1, 4.19.0 to 4.19.x

Identifiers

  • CVE-2026-40860
  • GHSA-m5vh-3fw5-5wgh

Timeline

  • 2026-04-27: disclosed: Public disclosure via GitHub Advisory Database and NVD
  • 2026-04-27: patched: Patches available in versions 4.14.7, 4.18.2, and 4.20.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.