CVE-2026-85313
Camel-Jetty: cross-origin credential exposure - setting enableCORS installed Jetty's CrossOriginFilter with its allow-all defaults, so every origin was accepted and credentials were granted to all of them
Description
Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the platform-http-vertx advisory published alongside it, in a different component.
Mitigation
Credit
This issue was discovered by Claude Security Scan Tool
Notes
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24450 refers to the various commits that resolved the issue, and has more details.
The fix was merged on main in https://github.com/apache/camel/pull/25829 (commit 6e3e4ec510b4966c70ad99b3c032e27d6adbef9d), backported to camel-4.22.x in https://github.com/apache/camel/pull/25937 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da) and to camel-4.18.x in https://github.com/apache/camel/pull/25938 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7).
The issue is classified as CWE-942 Permissive Cross-domain Policy with Untrusted Domains. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later.