Is CVE-2026-95664 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95664 being exploited in the wild.

How severe is CVE-2026-95664?

Medium severity, with a CVSS score of 5.4, published 26 October 2026.

Which products and versions are affected?

Apache Camel 4.8.0 before 4.18.5, 4.19.0 before 4.22.2.

How is CVE-2026-95664 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-95664?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95664: Apache Camel AWS2-S3 expression language injection in key handling

CVE-2026-95664 · Severity: medium · CVSS 5.4 · Published 2026-10-26

Apache Camel's AWS S3 connector incorrectly evaluates object key names as code expressions, allowing an attacker who can upload objects to an S3 bucket to execute arbitrary expressions in the Camel process. These expressions can read sensitive system properties, environment variables, and credentials, or invoke methods on application objects. This affects routes that copy object names between S3 buckets.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-95664 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95664 being exploited in the wild.
How severe is CVE-2026-95664?: Medium severity, with a CVSS score of 5.4, published 26 October 2026.
Which products and versions are affected?: Apache Camel 4.8.0 before 4.18.5, 4.19.0 before 4.22.2.
Is there a fix for CVE-2026-95664?: Yes: fixed in Camel 4.23.0, 4.22.2, 4.18.5. Until then: For routes passing exchanges from aws2-s3 consumer to producer, remove the CamelAwsS3Key header with removeHeader("CamelAwsS3Key") before the producer so the configured keyName is used instead, or reject exchanges where CamelAwsS3Key contains ${ or $simple{. As defense in depth, restrict write access to source buckets to trusted principals only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95664 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-95664?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Camel 4.23.0, 4.22.2, 4.18.5

For routes passing exchanges from aws2-s3 consumer to producer, remove the CamelAwsS3Key header with removeHeader("CamelAwsS3Key") before the producer so the configured keyName is used instead, or reject exchanges where CamelAwsS3Key contains ${ or $simple{. As defense in depth, restrict write access to source buckets to trusted principals only.

Technical details

The camel-aws2-s3 producer evaluates object key names through the Simple expression language if they contain ${ or $simple{ markers, even when the key comes from the CamelAwsS3Key message header set by the consumer with untrusted bucket object names. An attacker able to upload objects to a source bucket can craft object names as expressions to leak credentials and system properties, or invoke registry methods. The vulnerability affects versions 4.8.0–4.18.4, 4.19.0–4.22.1; versions before 4.8.0 are unaffected.

Affected products

Apache Camel 4.8.0 before 4.18.5, 4.19.0 before 4.22.2

Timeline

2026-10-26: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.