{"id":"CVE-2026-84176","kind":"vulnerability","aliases":["CVE-2026-84176"],"related":[],"title":"Apache Camel: Platform HTTP Vert.x CORS handler lets any origin read responses","description":"Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\n\ncreateCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another. For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.","summary":"The CORS handler in Apache Camel's Platform HTTP Vert.x component sent Access-Control-Allow-Credentials: true on every response and reflected any caller's Origin when no origin list was configured. A web page on any origin could make credentialed cross-origin requests to the Camel endpoint and read the responses.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-camel","java","package","platform-http-vertx"],"not_affected_if":["default-config-not-used","explicit-cors-origins","fixed-version"],"how_to_check":"- Check the Camel version in the project's dependency file (pom.xml or build.gradle) for camel-platform-http-vertx; affected versions are 4.0.0 to before 4.18.5 and 4.19.0 to before 4.22.1.\n- Search the application configuration for `camel.server.cors.origins`; if it is missing or empty, the handler allows every origin.","fix":"- Upgrade Apache Camel to `4.23.0`.\n- On the 4.18.x LTS stream, upgrade to `4.18.5`; on the 4.22.x LTS stream, upgrade to `4.22.1`.\n- If upgrading now is not possible, set `camel.server.cors.origins` to the explicit list of origins that need access.","status":"open","published_at":"2026-10-19T11:17:21+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:13+00:00","updated_at":"2026-10-25T03:57:13+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:57:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Camel to `4.23.0`.\n- On the 4.18.x LTS stream, upgrade to `4.18.5`; on the 4.22.x LTS stream, upgrade to `4.22.1`.\n- If upgrading now is not possible, set `camel.server.cors.origins` to the explicit list of origins that need access.","reach":"internet","title":"Apache Camel: Platform HTTP Vert.x CORS handler lets any origin read responses","impact":"medium","summary":"The CORS handler in Apache Camel's Platform HTTP Vert.x component sent Access-Control-Allow-Credentials: true on every response and reflected any caller's Origin when no origin list was configured. A web page on any origin could make credentialed cross-origin requests to the Camel endpoint and read the responses.","category":"package","nicknames":[],"who_cares":["apache-camel","java","platform-http-vertx"],"confidence":0.8,"needs_auth":"no","worst_case":"Cross-origin pages read responses from the Camel endpoint using the visitor's credentials","analyst_note":"","how_to_check":"- Check the Camel version in the project's dependency file (pom.xml or build.gradle) for camel-platform-http-vertx; affected versions are 4.0.0 to before 4.18.5 and 4.19.0 to before 4.22.1.\n- Search the application configuration for `camel.server.cors.origins`; if it is missing or empty, the handler allows every origin.","needs_analyst":false,"not_affected_if":["default-config-not-used","explicit-cors-origins","fixed-version"],"who_is_affected":"Applications that expose a Camel route through the Platform HTTP Vert.x component with CORS handling in use are exposed, most clearly when `camel.server.cors.origins` is unset. Systems that do not use this component, or that keep an explicit origin list, are less exposed. Teams on the fixed versions can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":3783,"output_tokens":706,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-84176':15A,18A '4.0.0':104C '4.18':242C '4.18.5':106C,250C '4.19.0':108C '4.22':254C '4.22.1':110C,262C '4.23.0':234C 'access':41B,114C,171C,264C,339C 'access-control-allow-credenti':40B,113C,263C 'access-control-allow-origin':170C 'actual':281C 'affect':100C 'allow':43B,116C,149C,160C,173C,266C 'anoth':322C 'any-origin':180C 'apach':1A,20B,32B,92C,101C,232C 'apache-camel':19B 'around':206C 'back':168C 'cach':314C 'caller':52B,164C 'camel':2A,21B,33B,76B,93C,102C,224C,233C 'camel.server.cors.origins':151C,330C 'cannot':315C,326C 'carri':134C 'check':122C 'compon':38B,97C 'configur':60B,183C,282C 'control':42B,115C,172C,265C 'cor':6A,29B 'could':67B,214C 'createcorshandl':111C 'credenti':44B,69B,117C,179C,217C,267C,295C 'cross':71B,84C,219C 'cross-domain':83C 'cross-origin':70B,218C 'cve':13A,16A 'decid':146C 'deploy':324C 'domain':85C,89C 'echo':162C 'endpoint':77B,225C 'everi':47B,129C,157C 'explicit':333C 'express':190C 'fetch':186C 'fix':236C 'grant':298C 'handler':7A,30B,143C,155C 'header':125C,137C 'http':4A,26B,36B,95C 'immedi':328C 'includ':138C 'issu':99C,238C 'java':22B 'leav':342C 'let':8A 'list':58B,286C,334C 'liter':193C 'lts':244C,256C 'make':68B,216C 'match':276C 'need':338C 'one':317C 'oper':280C 'origin':10A,54B,57B,66B,72B,121C,136C,141C,158C,167C,174C,182C,201C,213C,220C,275C,278C,285C,288C,301C,307C,318C,336C 'outsid':119C 'packag':23B 'page':63B,210C 'permiss':82C 'platform':3A,25B,35B,94C 'platform-http-vertx':24B 'polici':86C 'precis':197C 'produc':177C 'rather':340C 'read':11A,79B,227C 'reflect':50B,199C,291C,309C 'refus':188C 'releas':245C,257C 'request':73B,133C,221C,274C 'respons':12A,48B,81B,130C,139C,229C,320C 'rule':208C 'sent':39B,270C 'serv':316C 'set':112C,304C,329C 'share':313C 'specif':187C 'still':290C 'stream':246C,258C 'therefor':215C 'togeth':175C 'treat':156C 'true':45B,118C 'unset':153C,344C 'untrust':88C 'upgrad':230C,248C,260C,327C 'user':239C,251C 'usual':204C 'vari':300C 'vert.x':5A,37B 'vertx':27B,96C 'vulner':90C 'way':205C 'web':62B 'went':126C 'whenev':305C 'wildcard':194C 'x':243C,255C","nicknames":[],"mitigations":[],"who_affected":"Applications that expose a Camel route through the Platform HTTP Vert.x component with CORS handling in use are exposed, most clearly when `camel.server.cors.origins` is unset. Systems that do not use this component, or that keep an explicit origin list, are less exposed. Teams on the fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T11:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84176","severity":null,"published_at":"2026-10-19T11:17:21+00:00","modified_at":"2026-10-19T20:45:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}