Is CVE-2026-85312 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85312 being exploited in the wild.

How severe is CVE-2026-85312?

Medium severity, with a CVSS score of 4.8, published 19 October 2026.

Which products and versions are affected?

Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1.

How is CVE-2026-85312 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85312?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85312: Apache Camel Core saga processor header injection

CVE-2026-85312 · Severity: medium · CVSS 4.8 · Published 2026-10-19

Apache Camel is an integration framework that processes messages through various processors, including sagas that coordinate long-running distributed actions. An attacker can inject an unvalidated HTTP header into inbound messages to hijack saga routing, attaching their requests to sagas started by others or triggering unwanted compensation actions. This affects deployments using Camel's saga processor with an LRA coordinator.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-85312 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85312 being exploited in the wild.
How severe is CVE-2026-85312?: Medium severity, with a CVSS score of 4.8, published 19 October 2026.
Which products and versions are affected?: Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1.
Is there a fix for CVE-2026-85312?: Yes: fixed in 4.18.5, 4.22.1, 4.23.0. Until then: For deployments unable to upgrade immediately, strip the Long-Running-Action header at the trust boundary by adding removeHeaders("Long-Running-Action") on every consumer that accepts messages from untrusted senders. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85312 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85312?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.18.5, 4.22.1, 4.23.0

For deployments unable to upgrade immediately, strip the Long-Running-Action header at the trust boundary by adding removeHeaders("Long-Running-Action") on every consumer that accepts messages from untrusted senders.

Technical details

The saga processor improperly validates the Long-Running-Action header to determine saga membership. Because the header name lacks a Camel prefix, it bypasses consumer header filters and can be supplied by untrusted external senders. An attacker can inject this header to route their exchange to a saga initiated by another party or associate compensation with actions they did not start. The vulnerability is limited to deployments actively using saga services with an LRA coordinator.

Affected products

Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1

Timeline

2026-10-15: disclosed
2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.