CVE-2026-83531: Apache Camel code injection in dynamic-router-control endpoint

CVE-2026-83531 · Severity: high · CVSS 8.8 · Published 2026-10-19

Apache Camel is an integration framework that routes and processes messages between applications. The dynamic-router-control endpoint allows attackers to inject and execute arbitrary expressions by supplying untrusted predicate expressions in control messages, potentially leading to remote code execution with the privileges of the Camel process.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-83531 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83531 being exploited in the wild.
How severe is CVE-2026-83531?
High severity, with a CVSS score of 8.8, published 19 October 2026.
Which products and versions are affected?
Apache Camel 4.4.0 to 4.18.4, 4.19.0 to 4.22.0.
Is there a fix for CVE-2026-83531?
Yes: fixed in Apache Camel 4.23.0, 4.22.1, 4.18.5. Until then: Do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint. Where control messages must cross such transports, authenticate senders and remove the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers before the message reaches the endpoint. After upgrading, keep the allowPredicateFromMessage option disabled unless all control message senders are trusted. Restrict access to transports that feed the control endpoint, and use the allowedSchemes option to limit which endpoints subscriptions may target. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83531 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-83531?
Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Apache Camel 4.23.0, 4.22.1, 4.18.5

Do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint. Where control messages must cross such transports, authenticate senders and remove the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers before the message reaches the endpoint. After upgrading, keep the allowPredicateFromMessage option disabled unless all control message senders are trusted. Restrict access to transports that feed the control endpoint, and use the allowedSchemes option to limit which endpoints subscriptions may target.

Technical details

An expression language injection vulnerability exists in the DynamicRouterControlProducer component, which accepts predicate expressions and language types from incoming message headers and bodies without validation or allowlisting. An attacker with the ability to send messages to a transport that feeds the dynamic-router-control endpoint can supply arbitrary expressions in the CamelDynamicRouterPredicate header or predicate field, which are compiled and evaluated with no restrictions. The simple language is always present as the default, making removal of optional expression languages insufficient to prevent exploitation.

Affected products

  • Apache Camel 4.4.0 to 4.18.4, 4.19.0 to 4.22.0

Timeline

  • 2026-10-19: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.