Medium [CVE-2026-84176] Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component
This medium-severity Apache Software Foundation advisory covers CVE-2026-84176 affecting Apache Camel Platform.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow.
When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin.
Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured.
- 4.0.0 before 4.18.5
- 4.19.0 before 4.22.1
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
- 4.18.5
- 4.22.1
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Mitigation checklist
- Upgrade to Apache Camel 4.23.0, which fixes the issue.
- Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
- Users on the 4.22.x LTS releases stream should upgrade to 4.22.1.
- For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-85316Oct 19, 2026Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP
- CVE-2026-85254Oct 19, 2026Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP
- CVE-2026-66908Aug 24, 2026Apache Camel Platform authentication bypass
- CVE-2026-111422Oct 26, 2026Apache Airflow SSH provider command injection
- CVE-2026-115748Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions
- CVE-2026-115721Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.