CVE-2026-84176
Camel-Platform-HTTP-Vertx: cross-origin credential exposure - Access-Control-Allow-Credentials was set outside the origin check and the caller's own Origin was reflected back when no origin list was configured, producing a credentialed any-origin CORS policy
Description
createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses.
Mitigation
Credit
This issue was discovered by Claude Security Scan Tool
Notes
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24436 refers to the various commits that resolved the issue, and has more details.
The fix was merged on main in https://github.com/apache/camel/pull/25820 (commit 4b557e4e82048515b0141f4e3594fbecf7dc741c), backported to camel-4.22.x in https://github.com/apache/camel/pull/25937 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) and to camel-4.18.x in https://github.com/apache/camel/pull/25938 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7).
The issue is classified as CWE-942 Permissive Cross-domain Policy with Untrusted Domains. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later.