Live › vulnerability › CVE-2026-85300
Go to dashboardThe Apache Camel PQC component wrote generated key material to disk using the process umask instead of owner-only permissions. Other local accounts on hosts with a permissive umask can read the private key and use it to defeat signatures and key exchanges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments running the Apache Camel PQC component on versions from 4.12.0 before 4.18.5, or from 4.19.0 before 4.22.1, that generate key material to disk. The risk depends on the host umask allowing group or world read and on other local accounts existing on the same host. Deployments that do not use the PQC component, or that run on a version already upgraded, can skip it.
No product ranges from the sources yet.
mvn dependency:tree | grep camel-pqc or the equivalent in your build tool, and confirm it falls in 4.12.0 to before 4.18.5, or 4.19.0 to before 4.22.1.ls -l (group or world read bits set means exposure).umask in the service account's environment.4.23.0, or to 4.18.5 on the 4.18.x LTS stream, or 4.22.1 on the 4.22.x LTS stream.umask 077 for the process.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Default Permissions vulnerability in Apache Camel PQC component.
This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.
When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than restricting the file to its owner. On a host whose umask allows group or world read, the private key was therefore readable by other local accounts. The exposure is to a local party rather than to the remote sender that the Camel threat model treats as the primary adversary, which is why the severity is assessed low, but the consequence where it applies is complete: possession of the private key defeats every signature and key exchange the deployment performs with it.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Key material is now written with owner-only permissions. For deployments that cannot upgrade immediately, place the key directory on a path only the service account can traverse, and tighten the process umask. Key material already written with permissive permissions should be treated as exposed and rotated.
This page as .md · .json · in your agent: get_signal("CVE-2026-85300")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.