CVE-2026-43867: Apache Camel insecure deserialization in PQC AWS Secrets Manager

CVE-2026-43867 · Severity: critical · CVSS 9.8 · Published 2026-07-06

Apache Camel's post-quantum cryptography component stores encryption key metadata in AWS Secrets Manager. An attacker with write access to this secret can inject a malicious serialized object that executes arbitrary code when the application deserializes it during normal key operations. This allows complete takeover of systems managing cryptographic keys, potentially exposing all encrypted data and operations that depend on those keys.

Technologies: Apache Camel, org.apache.camel:camel-pqc (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-43867 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43867 being exploited in the wild.
How severe is CVE-2026-43867?
Critical severity, with a CVSS score of 9.8, published 6 July 2026.
Which products and versions are affected?
Apache Camel 4.18.0 through 4.18.2, 4.19.0 through 4.20.x; org.apache.camel:camel-pqc (Maven) ECOSYSTEM:introduced=4.18.0,fixed=4.18.3.
Is there a fix for CVE-2026-43867?
Yes. org.apache.camel:camel-pqc (Maven): upgrade to 4.18.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43867 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-43867?
Check whether you run Apache Camel or org.apache.camel:camel-pqc (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-pqc (Maven): upgrade to 4.18.3 or later
    # set org.apache.camel:camel-pqc to 4.18.3 in your pom.xml or build.gradle

Technical details

The AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() method in the camel-pqc component deserializes KeyMetadata objects using a raw java.io.ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist. The type cast to KeyMetadata occurs only after deserialization, meaning arbitrary readObject() side effects execute before any type validation. An attacker with secretsmanager:PutSecretValue permission on the metadata secret can store a crafted serialized gadget chain that achieves remote code execution in the application's security context. Attack precondition: the attacker must have AWS IAM write permissions to the specific Secrets Manager secret. Patches are available in Apache Camel 4.18.3 (LTS stream) and 4.21.0 (main stream). Temporary mitigation involves restricting IAM write permissions to the metadata secret and storing PQC key material in a separate secret.

Affected products

  • Apache Camel 4.18.0 through 4.18.2, 4.19.0 through 4.20.x

Identifiers

  • CVE-2026-43867
  • GHSA-7cmx-qjh8-7v3v

Timeline

  • 2026-07-06: disclosed: Vulnerability disclosed and published by GitHub Advisory Database and NVD
  • 2026-07-06: patched: Patches released: Apache Camel 4.18.3 (LTS) and 4.21.0 (main)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.