{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84176", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-01T09:24:51.254Z", "datePublished": "2026-10-19T10:30:00.854Z", "dateUpdated": "2026-10-19T10:30:00.854Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-19T10:30:00.854Z"}, "title": "Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection", "problemTypes": [{"descriptions": [{"description": "CWE-942 Permissive Cross-domain Policy with Untrusted Domains", "lang": "en", "cweId": "CWE-942", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Camel", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.camel:camel-platform-http-vertx", "packageURL": "pkg:maven/org.apache.camel/camel-platform-http-vertx", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.18.5", "versionType": "maven"}, {"status": "affected", "version": "4.19.0", "lessThan": "4.22.1", "versionType": "maven"}, {"status": "unaffected", "version": "4.18.5", "versionType": "maven"}, {"status": "unaffected", "version": "4.22.1", "versionType": "maven"}, {"status": "unaffected", "version": "4.23.0", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\n\ncreateCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another. For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component.<br><br>This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.</p><p><br>createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses.<br><br>Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another. For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.</p>"}]}], "references": [{"url": "https://camel.apache.org/security/CVE-2026-84176.html", "name": "Apache Camel Security Advisory - CVE-2026-84176", "tags": ["vendor-advisory"]}, {"url": "https://issues.apache.org/jira/browse/CAMEL-24436", "name": "CAMEL-24436", "tags": ["issue-tracking"]}, {"url": "https://github.com/apache/camel/pull/25820", "name": "Fix on main, released in 4.23.0 (commit 4b557e4e82048515b0141f4e3594fbecf7dc741c)", "tags": ["patch"]}, {"url": "https://github.com/apache/camel/pull/25937", "name": "Backport to camel-4.22.x, released in 4.22.1 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da)", "tags": ["patch"]}, {"url": "https://github.com/apache/camel/pull/25938", "name": "Backport to camel-4.18.x, released in 4.18.5 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7)", "tags": ["patch"]}], "metrics": [{"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another.</p>"}]}], "credits": [{"lang": "en", "value": "Claude Security", "type": "finder"}, {"lang": "en", "value": "Andrea Cosentino", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.camel:camel-platform-http-vertx", "packageURL": "pkg:maven/org.apache.camel/camel-platform-http-vertx", "product": "Apache Camel", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.18.5", "status": "affected", "version": "4.0.0", "versionType": "maven"}, {"lessThan": "4.22.1", "status": "affected", "version": "4.19.0", "versionType": "maven"}, {"status": "unaffected", "version": "4.18.5", "versionType": "maven"}, {"status": "unaffected", "version": "4.22.1", "versionType": "maven"}, {"status": "unaffected", "version": "4.23.0", "versionType": "maven"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\n\ncreateCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration that the fetch specification refuses to express as a literal wildcard, which is precisely why reflecting the origin is the usual way around that rule. A page on any origin could therefore make credentialed cross-origin requests to the Camel endpoint and read the responses.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Access-Control-Allow-Credentials is now sent only when the request origin matched an origin the operator actually configured. With no origin list the origin is still reflected, as before, but credentials are not granted, and Vary: Origin is now set whenever the origin is reflected so that a shared cache cannot serve one origin's response to another. For deployments that cannot upgrade immediately, set camel.server.cors.origins to the explicit list of origins that need access rather than leaving it unset."}], "id": "CVE-2026-84176", "lastModified": "2026-10-19T11:17:21.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@apache.org", "type": "Secondary"}]}, "published": "2026-10-19T11:17:21.750", "references": [{"source": "security@apache.org", "url": "https://camel.apache.org/security/CVE-2026-84176.html"}, {"source": "security@apache.org", "url": "https://github.com/apache/camel/pull/25820"}, {"source": "security@apache.org", "url": "https://github.com/apache/camel/pull/25937"}, {"source": "security@apache.org", "url": "https://github.com/apache/camel/pull/25938"}, {"source": "security@apache.org", "url": "https://issues.apache.org/jira/browse/CAMEL-24436"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-942"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{}