Live › vulnerability › CVE-2026-84176
Go to dashboardThe CORS handler in Apache Camel's Platform HTTP Vert.x component sent Access-Control-Allow-Credentials: true on every response and reflected any caller's Origin when no origin list was configured. A web page on any origin could make credentialed cross-origin requests to the Camel endpoint and read the responses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that expose a Camel route through the Platform HTTP Vert.x component with CORS handling in use are exposed, most clearly when is unset. Systems that do not use this component, or that keep an explicit origin list, are less exposed. Teams on the fixed versions can skip it.
camel.server.cors.originsNo product ranges from the sources yet.
camel.server.cors.origins; if it is missing or empty, the handler allows every origin.4.23.0.4.18.5; on the 4.22.x LTS stream, upgrade to 4.22.1.camel.server.cors.origins to the explicit list of origins that need access.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another. For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.
This page as .md · .json · in your agent: get_signal("CVE-2026-84176")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.