Apache Camel Security Advisory - CVE-2026-46590

Apache Camel security advisory: CVE-2026-46590

Severity

MEDIUM

Summary

Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

Versions affected

From 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0.

Versions fixed

4.18.3 and 4.21.0

Description

The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadata back from the configured secret backend by deserializing a Base64-wrapped value with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. The same unfiltered legacy-migration read also remained in FileBasedKeyLifecycleManager (for the stored KeyPair and KeyMetadata). A principal who can write to the operator-controlled backend that holds these values - the HashiCorp Vault KV path, or the AWS Secrets Manager secret (requiring a Vault token or secretsmanager:PutSecretValue) - could store a crafted serialized object that is deserialized during normal key-lifecycle operations, potentially leading to code execution in the context of the application that manages the keys. This is an incomplete-remediation follow-on to CVE-2026-40048 (CAMEL-23200), which changed FileBasedKeyLifecycleManager to store metadata as JSON / PKCS#8 / X.509 but did not add an ObjectInputFilter, did not cover the Vault and AWS sibling managers, and left FileBasedKeyLifecycleManager's own legacy-migration deserialization unfiltered.

Notes

The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23726 refers to the various commits that resolved the issue, and have more details. The fix was merged on main in https://github.com/apache/camel/pull/23912 (commit feea08e7847f35dc0e177652b0b02bd45f6c1b4f) and backported to camel-4.18.x in https://github.com/apache/camel/pull/23914 (commit 12a9ac3c94d6fda12d16b2c0039db41c6204727e). The fix introduces a shared KeyMetadataCodec that stores key metadata as JSON for all three KeyLifecycleManager implementations, constrains the remaining legacy ObjectInputStream reads (KeyPair, KeyMetadata) with an allow-list ObjectInputFilter, and makes the FileBasedKeyLifecycleManager metadata format detection binary-safe so legacy values are correctly migrated to JSON on the next update. The issue is classified as CWE-502 (Deserialization of Untrusted Data) and is an incomplete-remediation follow-on to CVE-2026-40048 (CAMEL-23200), which changed FileBasedKeyLifecycleManager to a JSON / PKCS#8 / X.509 storage format but did not add an ObjectInputFilter and did not cover the HashiCorp Vault and AWS Secrets Manager sibling managers. Under the project’s published security model, raw ObjectInputStream deserialization of persisted state in a key store is an in-scope class; exploitation requires write access to the operator-controlled key backend (where a principal could already read or replace the private keys), so it is handled as defensive hardening rather than unauthenticated remote code execution, and the originally reported CVSS 8.1 / network-RCE framing was not retained on review. The camel-pqc key-lifecycle managers are not present before 4.16.0, so the 4.14.x release line is not affected.

Mitigation

Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the key backend so that only the application’s own identity can write the camel-pqc secrets (least-privilege HashiCorp Vault policies and secretsmanager:PutSecretValue IAM), and keep the PQC key material in a backend separate from any data that less-trusted principals can write.

Credit

This issue was discovered by Yu Bao from PayPal

References

PGP signed advisory data: CVE-2026-46590.txt.asc
Mitre CVE Entry: https://www.cve.org/CVERecord?id=CVE-2026-46590