CVE-2026-95664
Description
A flaw was found in the Apache Camel camel-aws2-s3 component. An attacker with permission to upload or name objects in an Amazon Simple Storage Service (Amazon S3) bucket consumed by a Camel route can provide a crafted object key containing expression language syntax. When the component processes the object, it automatically evaluates the untrusted key within the application runtime. This vulnerability can lead to information disclosure by exposing sensitive configuration properties and environment variables, or allow unauthorized method execution within the application.
Statement
Red Hat Product Security rates the impact of this vulnerability as Moderate because exploitation requires authenticated or authorized access to upload or manipulate object names in the source storage bucket. In affected Red Hat builds of Apache Camel and OpenShift Serverless Knative integrations, routes that transfer data directly between S3 consumers and producers without sanitizing exchange headers may evaluate embedded Simple language syntax within the object key. Successful evaluation could expose environment variables or execute registry bean methods within the running integration context, though exfiltration is constrained by destination bucket visibility and the permissions granted to the application runtime.
Mitigation
To mitigate this vulnerability without replacing component packages, configure Camel routes to prevent untrusted S3 object keys from reaching the aws2-s3 producer:
1. In routes transferring messages from an aws2-s3 consumer to an aws2-s3 producer, explicitly remove the `CamelAwsS3Key` header prior to the producer step using `<removeHeader name="CamelAwsS3Key"/>` in XML DSL or `.removeHeader("CamelAwsS3Key")` in Java DSL. Define the intended object destination via the producer endpoint's `keyName` option.
2. Alternatively, insert route validation logic to reject or filter out exchanges whose `CamelAwsS3Key` header contains expression markers such as `${` or `$simple{`.
3. As an operational control, restrict write and upload permissions on source S3 buckets strictly to trusted principals.
Warning: Modifying and applying route configuration changes requires reloading or restarting the affected integration services, which may cause a temporary service disruption.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | 5.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
An attacker could insert an expression that references private data, which is then included in the output.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
An attacker could execute arbitrary expressions.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
