CVE-2026-88901
Description
A flaw was found in the Apache Camel Smooks component (camel-smooks). This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting a crafted XML message containing external entity references. Because the component processes incoming XML data without restricting external entity resolution by default, an attacker can read arbitrary local files accessible to the host process or issue unauthorized requests to internal network services.
Statement
Red Hat rates this issue as Important because remote, unauthenticated attackers can leverage default XML parsing behavior in camel-smooks to exfiltrate host filesystem data and trigger server-side request forgery. In typical Red Hat build of Apache Camel deployments, exploitation is possible without elevated privileges if an integration route accepts untrusted XML payloads for transformation via the Smooks component or data format. Routes that do not process external XML input, or that configure non-XML readers such as CSV, JSON, or EDI, are not exposed to this flaw.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disable external entity resolution and external DTD processing in the XML parser before handing input to Smooks: upgrade to Apache Camel 4.18.5, 4.22.1, or 4.23.0 (or the fixed Camel Smooks builds), which pre-parse XML using a hardened DocumentBuilder that disables external entities and external DTD loading before passing to Smooks, and add an allowExternalEntities option defaulting to false, closing all 2 injection vectors (external general entity declaration, DOCTYPE external subset resolution). Until patched, this is only a concern on Camel routes processing XML messages using camel-smooks with the default XML reader — Configurations using custom readers such as EDI, CSV, or JSON, and the marshalling direction are unaffected — so do not apply camel-smooks endpoints or data formats to XML messages received from untrusted senders. As a compensating measure, restrict outbound network egress from the Camel host process to contain unauthorized SSRF requests and internal network scanning. These controls limit blast radius and contain exploitation, but they do not fix the underlying XML external entity injection defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1317 XML External Entity Prevention (Secure XML Parser Configuration) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.2 | N/A | 8.2 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
