CVE-2026-27172 - Vulnerability Analysis

Overview

Apache Camel 3.0.0 < 4.14.6, 4.15.0 < 4.18.1 contains an insecure deserialization caused by unfiltered Java object deserialization in ConsulRegistry, letting attackers with write access to Consul KV store execute arbitrary code, exploit requires attacker to write malicious serialized objects.

Severity & Score

Impact

Attackers with write access to Consul KV store can execute arbitrary code in the Camel process, leading to full system compromise.

Mitigation

Upgrade to versions 4.14.6, 4.18.1, or 4.19.0 or later.

References

• https://camel.apache.org/security/CVE-2026-27172.html

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner