CVE-2026-40858 - Vulnerability Analysis

Overview

Apache Camel 4.0.0 < 4.14.7, 4.15.0 < 4.18.2, 4.19.0 < 4.20.0 contains an insecure deserialization caused by lack of ObjectInputFilter in ProtoStream-based remote aggregation repository, letting attackers with write access to Infinispan cache execute arbitrary code remotely, exploit requires attacker to write crafted serialized objects to cache.

Severity & Score

Impact

Attackers with write access to Infinispan cache can execute arbitrary code in the application context, leading to full system compromise.

Mitigation

Upgrade to versions 4.14.7, 4.18.2, or 4.20.0 or later.

References

• https://camel.apache.org/security/CVE-2026-40858.html

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner