CVE-2026-90885
Description
A flaw was found in Apache Camel's camel-saxon component. A remote attacker can exploit this vulnerability to cause information disclosure by sending specially crafted XML containing external entity declarations to an affected route. The issue occurs because the component's default parser configuration fails to restrict XML External Entity (XXE) references when evaluating XQuery expressions over certain XML message sources. As a result, the attacker could read sensitive local files accessible to the application process or trigger unauthorized outbound network requests.
Statement
This vulnerability is rated as Important because remote unauthenticated attackers can exploit it to disclose sensitive system files or initiate unauthorized server-side network requests. Exploitation is limited to scenarios where integration routes process untrusted XML input using Camel's Saxon component and evaluate XQuery expressions against message bodies explicitly structured as stream-based Source objects. Standard message payloads handled as strings, byte streams, or raw byte arrays are protected by default conversion routines and remain unaffected.
Mitigation
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to configure Saxon parser options to disallow DOCTYPE declarations and disable external entity resolution when evaluating XQuery expressions over XML Source payloads: upgrade to Apache Camel 4.18.5, 4.22.2, 4.23.0 (or the fixed Camel Saxon builds), which configure the default Saxon ParseOptions to disallow DOCTYPE declarations and disable external general entities, external parameter entities, and external DTD loading, closing all 3 injection vectors (crafted XML DOCTYPE declaration referencing external general entities, crafted XML DOCTYPE declaration referencing external parameter entities, crafted XML DOCTYPE declaration referencing external DTD subsets). Until patched, this is a concern on Camel routes evaluating XQuery over untrusted XML formatted as stream-based javax.xml.transform.Source payloads, so Avoid evaluating XQuery over message bodies structured as javax.xml.transform.Source from untrusted senders, or explicitly set the xquery endpoint configuration to a custom Saxon Configuration that rejects DOCTYPE declarations and external entities. These controls limit blast radius and contain exploitation, but they do not fix the underlying XML external entity reference restriction defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1317 XML External Entity Prevention (Secure XML Parser Configuration) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
If the attacker is able to include a crafted DTD and a default entity resolver is enabled, the attacker may be able to access arbitrary files on the system. By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. For example, a URI such as "file:///c:/winnt/win.ini" designates (in Windows) the file C:\Winnt\win.ini, or file:///etc/passwd designates the password file in Unix-based systems. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g., in an error message), thereby exposing the file contents.
Integrity
Technical Impact: Bypass Protection Mechanism
An attacker may supply a crafted DTD using URIs with schemes such as http://, forcing the application to make outgoing HTTP requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions; hide the source of attacks such as port scanning; or otherwise leverage the server's trust relationship with other entities.
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
The product could consume excessive CPU cycles or memory using a URI that points to a large file, or a device that always returns data such as /dev/random. Alternately, the URI could reference a file that contains many nested or recursive entity references to further slow down parsing.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
