Is CVE-2026-85296 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85296 being exploited in the wild.

How severe is CVE-2026-85296?

Medium severity, with a CVSS score of 6.5, published 19 October 2026.

Which products and versions are affected?

Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1.

How is CVE-2026-85296 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85296?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85296: Apache Camel AS2 cross-partner signing key confusion

CVE-2026-85296 · Severity: medium · CVSS 6.5 · Published 2026-10-19

Apache Camel is an open-source integration framework that processes messages between trading partners using the AS2 protocol. In multi-partner deployments, signing keys for secure message receipts were stored in shared memory instead of isolated per-request, allowing concurrent requests to observe each other's keys and sign receipts with the wrong partner's credentials. An attacker with access to observe message traffic could potentially attribute receipts to the wrong partner or impersonate their signing authority.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-85296 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85296 being exploited in the wild.
How severe is CVE-2026-85296?: Medium severity, with a CVSS score of 6.5, published 19 October 2026.
Which products and versions are affected?: Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1.
Is there a fix for CVE-2026-85296?: Yes: fixed in 4.18.5, 4.22.1, 4.23.0. Until then: For deployments unable to upgrade immediately, run a separate Camel context per trading partner to prevent signing material from being shared between them. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85296 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85296?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.18.5, 4.22.1, 4.23.0

For deployments unable to upgrade immediately, run a separate Camel context per trading partner to prevent signing material from being shared between them.

Technical details

The AS2 component stored per-request signing material in shared state accessible across requests rather than confining it to individual request contexts. This CWE-488 exposure affects the ResponseMDN (Message Disposition Notification) handling in concurrent or successive requests. In typical multi-partner deployments, ordinary traffic triggers the condition without attacker orchestration; concurrent requests can cross-observe signing keys and issue signed receipts attributed to the wrong partner.

Affected products

Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1

Timeline

2026-10-19: disclosed
2026-10-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.