Is CVE-2026-91858 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91858 being exploited in the wild.

How severe is CVE-2026-91858?

Medium severity, with a CVSS score of 6.5, published 19 October 2026.

Which products and versions are affected?

Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.0.

How is CVE-2026-91858 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-91858?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91858: Apache Camel FOP XML external entity injection via third-party transformer

CVE-2026-91858 · Severity: medium · CVSS 6.5 · Published 2026-10-19

Apache Camel's FOP producer component processes XSL-FO documents using XML transformers. When a third-party transformer library like Saxon-HE is present on the classpath, the component fails to restrict external entity resolution, allowing an attacker to read files accessible to the Camel process or trigger outbound requests to arbitrary hosts through a malicious XSL-FO document.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-91858 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91858 being exploited in the wild.
How severe is CVE-2026-91858?: Medium severity, with a CVSS score of 6.5, published 19 October 2026.
Which products and versions are affected?: Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.0.
Is there a fix for CVE-2026-91858?: Yes: fixed in 4.18.5, 4.22.1, 4.23.0. Until then: Do not send untrusted XSL-FO documents to a fop producer, or remove third-party JAXP TransformerFactory implementations such as Saxon-HE from the classpath to force use of the JDK transformer, which already refuses external DTDs under secure processing.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-15"},{"kind":"advisory","at":"2026-10-19"},{"kind":"patched","at":"2026-10-19","note":"Fix merged to main and backported to 4.18.x and 4.22.x LTS streams"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91858 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-91858?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.18.5, 4.22.1, 4.23.0

Do not send untrusted XSL-FO documents to a fop producer, or remove third-party JAXP TransformerFactory implementations such as Saxon-HE from the classpath to force use of the JDK transformer, which already refuses external DTDs under secure processing.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-15"},{"kind":"advisory","at":"2026-10-19"},{"kind":"patched","at":"2026-10-19","note":"Fix merged to main and backported to 4.18.x and 4.22.x LTS streams"}]

Technical details

FopProducer creates a TransformerFactory with only FEATURE_SECURE_PROCESSING enabled; while the JDK's default transformer blocks external DTD/stylesheet access under this feature, third-party JAXP implementations like Saxon-HE do not. An attacker can declare external DTDs or entities in an XSL-FO document that reach the producer, which are then resolved and expanded, enabling XXE attacks. The fix sets ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET to empty string in addition to FEATURE_SECURE_PROCESSING.

Affected products

Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.