dbcve.org
CamelApplication · Apache

CVE-2026-43867

CRITICAL · 9.8 CVSS v3.1 Published 2026-07-06
Fix available
A fix is available. Upgrade to 4.18.3 / 4.21.0 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click 7 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. A principal who can write to the AWS Secrets Manager secret that holds this metadata (requiring secretsmanager:PutSecretValue on that secret) could store a crafted serialized object that is deserialized during normal key-lifecycle operations, potentially leading to code execution in the context of the application that manages the keys. This is the same underlying defect, in the same code path and remediated by the same fix, as CVE-2026-46590, which was reported independently and additionally covers the HashiCorp Vault and file-based sibling managers; both are incomplete-remediation follow-ons to CVE-2026-40048 (CAMEL-23200). This issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the AWS Secrets Manager secret that holds the camel-pqc key metadata so that only the application’s own identity holds secretsmanager:PutSecretValue on it (least-privilege IAM), and keep the PQC key material in a secret separate from any data that less-trusted principals can write.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Apache Camel PQC component's AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() uses raw java.io.ObjectInputStream.readObject() without ObjectInputFilter or class allow-list to deserialize Base64-encoded KeyMetadata from AWS Secrets Manager. An attacker with secretsmanager:PutSecretValue permission on the secret can inject a malicious serialized object that executes code during deserialization before the KeyMetadata type cast occurs.

MitigationUpgrade to Apache Camel 4.21.0 or 4.18.3, or enforce least-privilege IAM to restrict secretsmanager:PutSecretValue access on the key metadata secret to only the application identity.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
CamelApplication
Affected:>= 4.18.0, < 4.18.3>= 4.19.0, < 4.21.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check Apache Camel version
    Locate the camel-core JAR file or check your dependency management (pom.xml, build.gradle, package.json) for the Apache Camel version. Run: jar tf camel-core-*.jar | grep 'camel-core' or inspect your dependency tree.
    Affected if Version is 4.18.0 through 4.18.2, or 4.19.0 through 4.20.x (anything < 4.18.3 or < 4.21.0)
  2. Verify PQC component is in use
    Search your codebase or application dependencies for 'camel-pqc' or 'org.apache.camel:camel-pqc'. Check your Camel route definitions for any references to 'pqc' component.
    Affected if The camel-pqc dependency is present in your application
  3. Confirm AwsSecretsManagerKeyLifecycleManager is configured
    Search configuration files (application.properties, application.yml, XML routes) for 'AwsSecretsManagerKeyLifecycleManager' or AWS Secrets Manager key management settings. Inspect your Camel context XML or Java DSL for PQC component configuration.
    Affected if AwsSecretsManagerKeyLifecycleManager is configured to manage keys via AWS Secrets Manager
  4. Inspect IAM policy for PutSecretValue access
    Review the IAM role or policy attached to the application identity. Check for 'secretsmanager:PutSecretValue' permission, specifically on the secret ARN used for key metadata storage.
    Affected if The application identity has secretsmanager:PutSecretValue permission on the key metadata secret (an attacker could inject malicious serialized payload)

You are affected if running a vulnerable Apache Camel version AND using the PQC component with AwsSecretsManagerKeyLifecycleManager configured, AND the application has PutSecretValue access to the Secrets Manager secret storing key metadata.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 4.18.3 / 4.21.0 or later
Fixed in 4.18.34.21.0
Interim mitigation

Upgrade to Apache Camel 4.21.0 or 4.18.3, or enforce least-privilege IAM to restrict secretsmanager:PutSecretValue access on the key metadata secret to only the application identity.

Recommended fix High confidence

4.21.0 (or 4.18.3 for 4.18.x LTS users)

  1. Identify your current Apache Camel version in your project dependencies (e.g., in pom.xml for Maven or build.gradle for Gradle)
  2. For projects on 4.19.x or later: upgrade the camel-bom and all camel-* dependencies to version 4.21.0
  3. For projects on 4.18.x LTS: upgrade the camel-bom and all camel-* dependencies to version 4.18.3
  4. After upgrading, rebuild and test your application to ensure the PQC component and KeyLifecycleManager functionality works correctly
  5. Verify that the AwsSecretsManagerKeyLifecycleManager is no longer using raw ObjectInputStream.readObject() without an ObjectInputFilter

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Camel Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing8.0 h
  • Review / QA4.0 h
30.0 hours of engineering $5,280
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,448.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-43867 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-43867 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data