Live › vulnerability › CVE-2026-85316
Go to dashboardApache Camel's Platform HTTP component treated any endpoint path beginning with 'proxy' as a proxy endpoint, such as proxyStatus or proxy-config. Those endpoints then forward requests onward, letting callers make the server relay traffic and reach whatever the forwarding path can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Camel 4.0.0 before 4.18.5 or 4.19.0 before 4.22.1 that expose HTTP endpoints through the Platform HTTP component. Exposure depends on having a route whose path begins with 'proxy' but was meant to serve its own content. Deployments with no such path, or that are already on a fixed version, are not affected.
No product ranges from the sources yet.
proxy but are not meant to be proxies, such as proxyStatus or proxy-configmvn dependency:tree | grep camel-platform-http and confirm it is below 4.18.5 on the 4.18 line or below 4.22.1 on the 4.22 line4.23.04.18.54.22.1proxy that is not intended as a proxyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with the string proxy, rather than by matching the path exactly. Any endpoint whose path merely begins with those characters - proxyStatus, proxy-config, proxying and so on - therefore became a proxy endpoint without the route author asking for it. A proxy endpoint forwards requests onward, so an endpoint that was intended to serve its own content instead relays traffic on behalf of whoever calls it, which is both a request forgery primitive and an exposure of whatever the forwarding path can reach.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Proxy mode is now selected by an exact path match rather than by prefix. For deployments that cannot upgrade immediately, rename any endpoint path that begins with proxy but is not intended to be a proxy.
This page as .md · .json · in your agent: get_signal("CVE-2026-85316")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.