CVE-2026-46590 camel vulnerability
Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadata back from the configured secret backend by deserializing a Base64-wrapped value with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. The same unfiltered legacy-migration read also remained in FileBasedKeyLifecycleManager (for the stored KeyPair and KeyMetadata). A principal who can write to the operator-controlled backend that holds these values - the HashiCorp Vault KV path, or the AWS Secrets Manager secret (requiring a Vault token or secretsmanager:PutSecretValue) - could store a crafted serialized object that is deserialized during normal key-lifecycle operations, potentially leading to code execution in the context of the application that manages the keys. This is an incomplete-remediation follow-on to CVE-2026-40048 (CAMEL-23200), which changed FileBasedKeyLifecycleManager to store metadata as JSON / PKCS#8 / X.509 but did not add an ObjectInputFilter, did not cover the Vault and AWS sibling managers, and left FileBasedKeyLifecycleManager's own legacy-migration deserialization unfiltered. This issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the key backend so that only the application's own identity can write the camel-pqc secrets (least-privilege HashiCorp Vault policies and secretsmanager:PutSecretValue IAM), and keep the PQC key material in a backend separate from any data that less-trusted principals can write.
Quick answer
apache camel should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- Review vendor advisory for affected versions.
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
CVE-2026-46590 affects Apache Camel PQC. Upgrade Apache Camel on the deployed branch to a fixed release (4.18.3, 4.21.0) and review routes that expose this component to external or user-controlled messages. Affected ranges in the local NVD record are 4.18.0 through before 4.18.3; 4.19.0 through before 4.21.0.
- Inventory every service, integration route, container image, and build manifest that includes Apache Camel PQC or transitive Camel modules related to PQC.
- Compare each deployed Camel version with the affected ranges for CVE-2026-46590; treat 4.0.x-4.14.7, 4.15.x-4.18.2, and 4.19.x-4.20.x as needing an upgrade when the component is present.
- Upgrade to the fixed Camel release for the active branch: 4.14.8, 4.18.3, 4.21.0, or a later vendor-supported release.
- Rebuild application artifacts and container images from a clean dependency lockfile so no vulnerable Camel module remains through transitive dependencies.
- Harden exposed routes by filtering user-controlled Camel headers and component-specific control headers before data reaches Camel producers or internal route logic.
- Rotate credentials or integration tokens if logs, routing headers, backend endpoints, or message contents may have been exposed or redirected through the vulnerable route.
- Deploy first to staging, run regression tests for the impacted route, then promote to production with monitoring for routing errors, authorization failures, SSRF attempts, and unexpected message destinations.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm dependency output shows Apache Camel 4.18.3, 4.21.0 or a later fixed release in every affected application.
- Run route-level tests that replay malicious or unexpected headers and verify they are removed, ignored, or rejected before reaching Camel internals.
- Check application logs after deployment for exceptions, leaked stack traces, SSRF indicators, unauthorized backend operations, or unexpected route destinations.
- Open the generated Fixnx page and confirm the canonical URL ends with camel-cve-2026-46590.
- Re-run sitemap validation and confirm camel-cve-2026-46590 appears once in sitemap.xml with the full CVE-2026-46590 suffix.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-46590?
apache camel should be checked against the vendor advisory and trusted references linked on this page.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.