Is CVE-2026-85300 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85300 being exploited in the wild.

How severe is CVE-2026-85300?

Medium severity, with a CVSS score of 5.5, published 19 October 2026.

Which products and versions are affected?

Apache Camel 4.12.0 to 4.18.4, 4.19.0 to 4.22.0.

How is CVE-2026-85300 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-85300?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85300: Apache Camel incorrect default file permissions in PQC component

CVE-2026-85300 · Severity: medium · CVSS 5.5 · Published 2026-10-19

Apache Camel's PQC (Post-Quantum Cryptography) component wrote generated cryptographic keys to disk using default file permissions, making them readable by other local user accounts on hosts with permissive umask settings. An attacker with local system access could steal the private key material, fully compromising the confidentiality and integrity of all cryptographic operations relying on those keys, including digital signatures and key exchanges.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-85300 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85300 being exploited in the wild.
How severe is CVE-2026-85300?: Medium severity, with a CVSS score of 5.5, published 19 October 2026.
Which products and versions are affected?: Apache Camel 4.12.0 to 4.18.4, 4.19.0 to 4.22.0.
Is there a fix for CVE-2026-85300?: Yes: fixed in Apache Camel 4.18.5, 4.22.1, 4.23.0. Until then: For deployments unable to upgrade immediately, restrict filesystem access by placing the key directory on a path traversable only by the service account, and tighten the process umask to remove group and world read permissions. Key material already written with permissive permissions must be treated as exposed and rotated. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85300 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-85300?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache Camel 4.18.5, 4.22.1, 4.23.0

For deployments unable to upgrade immediately, restrict filesystem access by placing the key directory on a path traversable only by the service account, and tighten the process umask to remove group and world read permissions. Key material already written with permissive permissions must be treated as exposed and rotated.

Technical details

The PQC component failed to explicitly set restrictive file permissions (owner-only) when writing generated key material to disk, instead relying on the process umask. On systems with permissive umask (e.g., 0022 or 0002), this allows local unprivileged users to read private keys. The vulnerability requires local filesystem access but no authentication or user interaction. A fix restricts key file creation to owner-only permissions (0600).

Affected products

Apache Camel 4.12.0 to 4.18.4, 4.19.0 to 4.22.0

Timeline

2026-10-15: disclosed
2026-10-15: patched: 4.23.0 released on main; 4.22.1 and 4.18.5 backports available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.