Is CVE-2026-85313 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85313 being exploited in the wild.

How severe is CVE-2026-85313?

Medium severity, with a CVSS score of 4.3, published 19 October 2026.

Which products and versions are affected?

Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.0.

How is CVE-2026-85313 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85313?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85313: Apache Camel Jetty permissive CORS policy with untrusted domains

CVE-2026-85313 · Severity: medium · CVSS 4.3 · Published 2026-10-19

Apache Camel's Jetty component, used to integrate HTTP endpoints into message-processing workflows, has a cross-origin request forgery vulnerability in its CORS (Cross-Origin Resource Sharing) feature. When an operator enables CORS via the enableCORS option, the component automatically installs a permissive policy that accepts requests from any origin and allows credentials, rather than requiring explicit configuration of trusted origins. An attacker could exploit this by creating a malicious web page that makes credentialed requests to the Camel endpoint from any origin and reads sensitive responses.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-85313 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85313 being exploited in the wild.
How severe is CVE-2026-85313?: Medium severity, with a CVSS score of 4.3, published 19 October 2026.
Which products and versions are affected?: Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.0.
Is there a fix for CVE-2026-85313?: Yes: fixed in Apache Camel 4.18.5, 4.22.1, 4.23.0. Until then: For deployments that cannot upgrade immediately, explicitly configure the CrossOriginFilter parameters rather than relying on enableCORS defaults, and name the allowed origins explicitly. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85313 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85313?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache Camel 4.18.5, 4.22.1, 4.23.0

For deployments that cannot upgrade immediately, explicitly configure the CrossOriginFilter parameters rather than relying on enableCORS defaults, and name the allowed origins explicitly.

Technical details

The vulnerability is a permissive cross-domain policy (CWE-942) in the Jetty component of Apache Camel. When enableCORS is set on a Jetty endpoint, it installs Jetty's CrossOriginFilter with default settings that accept all origins and allow credentials, without requiring the operator to explicitly list allowed origins. An attacker can craft a page served from any origin to make credentialed cross-origin requests to the affected endpoint and read responses. The fix disables credential granting by default and requires explicit origin configuration.

Affected products

Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.0

Timeline

2026-10-15: disclosed
2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.