CVE-2026-56139
Description
A flaw was found in the Apache Camel Undertow component. The camel-undertow HTTP server consumer, when processing errors, could return full Java stack traces in HTTP responses. This occurs because the muteException option, which controls what is returned to the client during errors, defaulted to false. An unauthenticated attacker could exploit this by sending a malformed request, leading to the disclosure of sensitive internal information such as credentials, internal network details, and application structure, which could aid in further attacks.
Statement
This Moderate impact information disclosure flaw in Apache Camel Undertow allows unauthenticated attackers to obtain sensitive internal system details. By default, the camel-undertow HTTP server consumer returns full Java stack traces in error responses, which can expose credentials, internal network configurations, and application structure. This is particularly relevant for Red Hat deployments utilizing camel-undertow where such endpoints are publicly accessible, as the muteException option was not honored for Rest DSL consumers in affected versions.
Mitigation
To mitigate this issue, configure the `camel-undertow` consumer to explicitly set `muteException=true`. This can be done by adding `?muteException=true` to the consumer URI (e.g., `undertow:http://0.0.0.0:8080/api?muteException=true`) or by setting the global property `camel.component.undertow.mute-exception=true`. This prevents Java stack traces from being returned in HTTP responses upon route processing errors. Note that this workaround may not apply to Rest DSL consumers in affected releases. A restart of the application or service hosting the Camel Undertow component may be required for the changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Often this will either reveal sensitive information which may be used to launch another, more focused attack or disclose private information stored in the server. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
