Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 2 vendors · 2 advisories

CVE-2026-84180

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component

CVE-2026-84180: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. Not in the CISA KEV catalog.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-84180 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Medium
CVSS base score
5.3 (Apache), 5.3 (Red Hat)
Weakness
CWE-209
Fixed releases
  • Apache: 4.18.5, 4.22.1
Vendor advisories
2 from Apache, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-84180; bulletin-wide values are not repeated here.

Is CVE-2026-84180 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-84180 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-84180?

Upgrade to a fixed release named by the vendor:

  • Apache: 4.18.5, 4.22.1
  • Upgrade to Apache Camel 4.23.0, which fixes the issue. (Apache)
  • Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. (Apache)

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2026-84180] Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component

    CVE-2026-84180Source published Source updated

    Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed on the consumer side, the Knative HTTP consumer wrote the resulting exception back to the remote caller as the response body, including its class name, message and stack trace. An external sender could therefore provoke a failure and read internal detail about the deployment: class and package names, file system or host names carried in exception messages, and the shape of the route. That detail is useful for building a more targeted attack, and where an exception message embeds configuration or connection strings it is disclosure in its own right.…

    Affected products in this advisory
    • Apache Camel Knative
    Source-reported affected versions
    • 4.0.0 before 4.18.5
    • 4.19.0 before 4.22.1
    Source-reported fixed versions
    • 4.18.5
    • 4.22.1
    Mitigation guidance
    • Upgrade to Apache Camel 4.23.0, which fixes the issue.
    • Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
    • Users on the 4.22.x LTS releases stream should upgrade to 4.22.1.
    • For deployments that cannot upgrade immediately, add an onException handler that sets the response body explicitly, so that the framework never writes the exception back to the caller.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2026-84180] Information disclosure via error responses

    CVE-2026-84180Source published Source updated

    Information disclosure via error responses. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-209. Affected products named by the advisory: OpenShift Serverless; Red Hat build of Apache Camel for Spring Boot 4.

    Related products — impact not confirmed
    • OpenShift Serverless
    • Red Hat build of Apache Camel for Spring Boot 4
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features