Is CVE-2026-6857 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6857 being exploited in the wild.

How severe is CVE-2026-6857?

High severity, with a CVSS score of 7.5, published 22 April 2026.

Which products and versions are affected?

Apache Software Foundation Camel Infinispan 4.10.0; org.apache.camel:camel-infinispan (Maven) < 4.20.0, ECOSYSTEM:introduced=0,fixed=4.20.0; Red Hat Camel Spring Boot 4.18.1.

Is there a fix for CVE-2026-6857?

Yes. org.apache.camel:camel-infinispan (Maven): upgrade to 4.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6857 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6857?

Check whether you run Apache Software Foundation Camel Infinispan, org.apache.camel:camel-infinispan (Maven) or Red Hat Camel Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6857: Apache Camel camel-infinispan RCE via Unsafe Deserialization

Q: Is there a fix for CVE-2026-6857?

Yes. org.apache.camel:camel-infinispan (Maven): upgrade to 4.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-6857 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-6857?

Check whether you run Apache Software Foundation Camel Infinispan, org.apache.camel:camel-infinispan (Maven) or Red Hat Camel Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6857 · Severity: high · CVSS 7.5 · Published 2026-04-22

Apache Camel's Infinispan component, which is used to integrate data grid storage into integration workflows, is vulnerable to a security flaw. An attacker with low-level access could send specially crafted data to the system, causing it to execute unauthorized commands. This could lead to a complete takeover of the affected server, potentially resulting in data theft or service disruption.

Technologies: org.apache.camel:camel-infinispan (Maven). Vendors: Apache Software Foundation, Maven, Red Hat.

Quick answers

Is CVE-2026-6857 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6857 being exploited in the wild.
How severe is CVE-2026-6857?: High severity, with a CVSS score of 7.5, published 22 April 2026.
Which products and versions are affected?: Apache Software Foundation Camel Infinispan 4.10.0; org.apache.camel:camel-infinispan (Maven) < 4.20.0, ECOSYSTEM:introduced=0,fixed=4.20.0; Red Hat Camel Spring Boot 4.18.1.
Is there a fix for CVE-2026-6857?: Yes. org.apache.camel:camel-infinispan (Maven): upgrade to 4.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6857 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6857?: Check whether you run Apache Software Foundation Camel Infinispan, org.apache.camel:camel-infinispan (Maven) or Red Hat Camel Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.camel:camel-infinispan (Maven): upgrade to 4.20.0 or later

# set org.apache.camel:camel-infinispan to 4.20.0 in your pom.xml or build.gradle

Technical details

A deserialization vulnerability exists in the camel-infinispan component of Apache Camel. The root cause is located in the ProtoStream remote aggregation repository, specifically within DefaultExchangeHolderUtils.deserialize(), which utilizes ClassLoadingAwareObjectInputStream.readObject() without implementing an ObjectInputFilter. A remote attacker with low privileges can exploit this by submitting malicious serialized objects over the network. If successful, this leads to arbitrary code execution (RCE) on the host system. The issue has been addressed in version 4.20.0 by implementing a deserialization filter that defaults to a safe allowlist.

Affected products

Apache camel-infinispan < 4.20.0

Identifiers

CVE-2026-6857
GHSA-xfxp-ppx7-cqrp

Timeline

2026-04-21: disclosed: Reported to Red Hat Bugzilla
2026-04-22: advisory: GitHub Advisory published
2026-05-14: patched: Red Hat released security update RHSA-2026:17668

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.