{"id":"CVE-2026-85300","kind":"vulnerability","aliases":["CVE-2026-85300"],"related":[],"title":"Apache Camel PQC: generated private keys written with permissive default permissions","description":"Incorrect Default Permissions vulnerability in Apache Camel PQC component.\n\nThis issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWhen the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than restricting the file to its owner. On a host whose umask allows group or world read, the private key was therefore readable by other local accounts. The exposure is to a local party rather than to the remote sender that the Camel threat model treats as the primary adversary, which is why the severity is assessed low, but the consequence where it applies is complete: possession of the private key defeats every signature and key exchange the deployment performs with it.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Key material is now written with owner-only permissions. For deployments that cannot upgrade immediately, place the key directory on a path only the service account can traverse, and tighten the process umask. Key material already written with permissive permissions should be treated as exposed and rotated.","summary":"The Apache Camel PQC component wrote generated key material to disk using the process umask instead of owner-only permissions. Other local accounts on hosts with a permissive umask can read the private key and use it to defeat signatures and key exchanges.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-camel","java","multi-user-hosts","package","self-hosted"],"not_affected_if":["default-config","no-pqc-component","restrictive-umask","upgraded-version"],"how_to_check":"- Check the Camel version with `mvn dependency:tree | grep camel-pqc` or the equivalent in your build tool, and confirm it falls in 4.12.0 to before 4.18.5, or 4.19.0 to before 4.22.1.\n- Look at existing generated key files on disk and check their mode with `ls -l` (group or world read bits set means exposure).\n- Check the process umask with `umask` in the service account's environment.","fix":"- Upgrade Apache Camel to `4.23.0`, or to `4.18.5` on the 4.18.x LTS stream, or `4.22.1` on the 4.22.x LTS stream.\n- Until upgraded, restrict the key directory to the service account and set a restrictive umask such as `umask 077` for the process.\n- Treat any key material already written with permissive permissions as exposed and rotate it.","status":"open","published_at":"2026-10-19T11:17:24+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:12:51+00:00","updated_at":"2026-10-25T04:12:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:12:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Camel to `4.23.0`, or to `4.18.5` on the 4.18.x LTS stream, or `4.22.1` on the 4.22.x LTS stream.\n- Until upgraded, restrict the key directory to the service account and set a restrictive umask such as `umask 077` for the process.\n- Treat any key material already written with permissive permissions as exposed and rotate it.","reach":"local","title":"Apache Camel PQC: generated private keys written with permissive default permissions","impact":"high","summary":"The Apache Camel PQC component wrote generated key material to disk using the process umask instead of owner-only permissions. Other local accounts on hosts with a permissive umask can read the private key and use it to defeat signatures and key exchanges.","category":"package","nicknames":[],"who_cares":["apache-camel","java","self-hosted","multi-user-hosts"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Other local accounts read the private key and forge signatures","analyst_note":"","how_to_check":"- Check the Camel version with `mvn dependency:tree | grep camel-pqc` or the equivalent in your build tool, and confirm it falls in 4.12.0 to before 4.18.5, or 4.19.0 to before 4.22.1.\n- Look at existing generated key files on disk and check their mode with `ls -l` (group or world read bits set means exposure).\n- Check the process umask with `umask` in the service account's environment.","needs_analyst":false,"not_affected_if":["default-config","no-pqc-component","upgraded-version","restrictive-umask"],"who_is_affected":"Deployments running the Apache Camel PQC component on versions from 4.12.0 before 4.18.5, or from 4.19.0 before 4.22.1, that generate key material to disk. The risk depends on the host umask allowing group or world read and on other local accounts existing on the same host. Deployments that do not use the PQC component, or that run on a version already upgraded, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000725,"input_tokens":3610,"output_tokens":727,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-85300':14A,17A '4.12.0':89C '4.18':211C '4.18.5':91C,219C '4.19.0':93C '4.22':223C '4.22.1':95C,231C '4.23.0':203C 'account':53B,143C,258C 'adversari':166C 'affect':85C 'allow':129C 'alreadi':268C 'apach':1A,19B,31B,79C,86C,201C 'apache-camel':18B 'appli':180C 'assess':173C 'camel':2A,20B,32B,80C,87C,159C,202C 'cannot':245C 'complet':182C 'compon':34B,82C,98C 'consequ':177C 'cve':12A,15A 'default':10A,75C,113C 'defeat':69B,188C 'deploy':195C,243C 'directori':251C 'disk':40B,104C 'everi':189C 'exchang':73B,193C 'expos':277C 'exposur':145C 'file':120C 'fix':205C 'generat':4A,36B,100C 'group':130C 'host':25B,29B,55B,126C 'immedi':247C 'incorrect':74C 'instead':45B 'issu':84C,207C 'java':21B 'key':6A,37B,64B,72B,101C,136C,187C,192C,232C,250C,266C 'local':52B,142C,149C 'low':174C 'lts':213C,225C 'materi':38B,102C,233C,267C 'model':161C 'multi':23B 'multi-user-host':22B 'owner':48B,123C,239C 'owner-on':47B,238C 'packag':26B 'parti':150C 'path':254C 'perform':196C 'permiss':9A,11A,50B,58B,76C,110C,241C,271C,272C 'place':248C 'possess':183C 'pqc':3A,33B,81C 'primari':165C 'privat':5A,63B,135C,186C 'process':43B,112C,264C 'produc':115C 'rather':116C,151C 'read':61B,133C 'readabl':139C 'releas':214C,226C 'remot':155C 'restrict':118C 'rotat':279C 'self':28B 'self-host':27B 'sender':156C 'servic':257C 'sever':171C 'signatur':70B,190C 'stream':215C,227C 'therefor':138C 'threat':160C 'tighten':262C 'travers':260C 'treat':162C,275C 'umask':44B,59B,114C,128C,265C 'upgrad':199C,217C,229C,246C 'use':41B,66B 'user':24B,208C,220C 'vulner':77C 'whose':127C 'world':132C 'written':7A,236C,269C 'wrote':35B,99C 'x':212C,224C","nicknames":[],"mitigations":[],"who_affected":"Deployments running the Apache Camel PQC component on versions from 4.12.0 before 4.18.5, or from 4.19.0 before 4.22.1, that generate key material to disk. The risk depends on the host umask allowing group or world read and on other local accounts existing on the same host. Deployments that do not use the PQC component, or that run on a version already upgraded, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T11:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85300","severity":null,"published_at":"2026-10-19T11:17:24+00:00","modified_at":"2026-10-19T20:45:51+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}