CVE-2026-78162
Camel-Hazelcast: Incomplete fix for CVE-2026-43865 leaves managed instances without a Java deserialization filter, enabling remote code execution
Description
The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values read from the backing ReplicatedMap with no class restriction. HazelcastDefaultComponent#getOrCreateHzClientInstance() builds its own ClientConfig when hazelcastMode=client is selected and neither a referenced ClientConfig nor hazelcastConfigUri is supplied, and likewise applied no filter, so client-mode endpoints behaved differently from node-mode endpoints for an otherwise identical configuration. In both cases an attacker able to publish into the Hazelcast cluster that the affected instance is attached to can cause a serialized Java object of their choosing to be deserialized inside Hazelcast's own serialization layer, before Camel processes the exchange, resulting in remote code execution. Hazelcast clusters have neither authentication nor TLS enabled by default. Selecting client mode is a topology choice rather than a security option, so neither path required the deployment to opt in to unsafe behaviour.
Mitigation
Credit
This issue was discovered by cattier from TCBS and Leon Zlobecki
Notes
The JIRA tickets: https://issues.apache.org/jira/browse/CAMEL-24413 and https://issues.apache.org/jira/browse/CAMEL-24420 refer to the various commits that resolved the issue, and have more details.
CAMEL-24413 covers ReplicatedHazelcastAggregationRepository and was merged on main in https://github.com/apache/camel/pull/25566 (commit 27836f4c17ed8cf33f1ef4dff9daed903b1b8907). CAMEL-24420 covers the ClientConfig that Camel builds for hazelcastMode=client endpoints and was merged on main in https://github.com/apache/camel/pull/25595 (commit 07318cfe7e07379a6155117d9c2cf27e99af4687). Both were backported together to camel-4.22.x in https://github.com/apache/camel/pull/25599 (commit 02a864ba28f80bf8076f00aa2094c46377a74f43) and to camel-4.18.x in https://github.com/apache/camel/pull/25600 (commit aea69111dc3ff1f8a32271fc95632aee32eb3f37). The fix adds an applyDefault(ClientConfig) overload to HazelcastSerializationFilterHelper and calls the helper on both previously uncovered paths, so every Hazelcast configuration that Camel builds itself now carries the default filter, while a user-supplied Config, ClientConfig or HazelcastInstance is still left untouched.
This advisory is an incomplete-fix follow-on to CVE-2026-43865 (CAMEL-23414), which introduced HazelcastSerializationFilterHelper and applied the default filter to four of the six Camel-built configuration sites. The two sites described above were not covered by that change, so deployments that upgraded to 4.14.8, 4.18.3 or 4.21.0 in response to that advisory remained exposed through them. This issue is distinct from the Hazelcast library deserialization advisories CVE-2016-10750 and CVE-2022-36418, which concern Hazelcast’s own code; this advisory concerns Apache Camel not applying the deserialization protections that Hazelcast provides. It belongs to the same Camel deserialization-hardening family as CVE-2026-25747 and CVE-2026-43865, and is classified as CWE-502 (Deserialization of Untrusted Data).
Releases from 4.0.0 through the 4.14.x line are affected as well, since ReplicatedHazelcastAggregationRepository has carried the defect since it was introduced, but those release lines reached end of life before this issue was resolved and no fix will be issued for them.