CVE-2026-84180
Description
A flaw was found in Apache Camel's Knative component. When message processing fails, the Knative HTTP consumer returns detailed exception information, including class names, messages, and stack traces, directly in the response body to the caller. A remote attacker could exploit this flaw by sending requests that trigger processing errors, leading to information disclosure. The exposed data may reveal internal application architecture, hostnames, or configuration settings, which can assist in planning further targeted attacks.
Statement
This vulnerability is rated as Moderate severity because unauthenticated remote actors can extract internal deployment details, including class paths and stack trace metadata, without granting them the ability to modify system state or execute unauthorized operations. In Red Hat OpenShift Serverless and Red Hat build of Apache Camel environments utilizing camel-knative consumers, unhandled exchange failures transmit stack trace information within HTTP responses. The disclosed information provides reconnaissance data that could facilitate further targeted attacks against the underlying infrastructure.
Mitigation
To reduce exposure to this vulnerability without upgrading:
1. Configure an explicit error handler in Apache Camel routes:
Define an `onException` handler across affected routes that intercepts failures and sets a generic, sanitized response body (for example, using `onException(Exception.class).handled(true).setBody(constant("Internal Server Error"))`). This prevents the runtime from serializing raw exceptions and stack traces back to remote clients.
2. Restrict network reachability:
Implement OpenShift NetworkPolicies or ingress filtering to limit access to Knative consumer HTTP endpoints strictly to trusted internal services and network namespaces.
Warning: Applying changes to Camel route definitions or updating deployment configurations requires restarting or redeploying the affected application pods, which may cause brief service interruptions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Often this will either reveal sensitive information which may be used to launch another, more focused attack or disclose private information stored in the server. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
