CVE-2026-101259
Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
02 Description
Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.34% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 27.7% of scored records. A rank, not a probability.
- NVD base score
- 5.3 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVD analysis status
- Awaiting Analysis. NVD last modified this record on 2026-10-26.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-26 08:36Z3 DAYS AGO
- Last updated
- 2026-10-26 08:36Z3 DAYS AGO
- Reserved
- 2026-09-28
- Assigning CNA
- apache
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 5.3)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-209Generation of Error Message Containing Sensitive InformationBase
- Data version
- 5.2
- Document digest
- f86e109f5f8f704638cdaf81d5d95256a9303a0bd2127568ce9ab25c185360cd
05 Affected products
06 References
- camel.apache.orgApache Camel Security Advisory - CVE-2026-101259https://camel.apache.org/security/CVE-2026-101259.html
- issues.apache.orgCAMEL-25087https://issues.apache.org/jira/browse/CAMEL-25087
- github.comFix on main, released in 4.23.0 (commit 2245feac8f4f9a85404b01d36114abdac504e7d1)https://github.com/apache/camel/pull/26994
- github.comBackport to camel-4.22.x for 4.22.2 (commit 868d56044119a8a975f583b63aeb9666cd952a88)https://github.com/apache/camel/pull/27046
- github.comBackport to camel-4.18.x, released in 4.18.5 (commit aaf5bbf81ede12837c9c65fa9106643fcb58b7c4)https://github.com/apache/camel/pull/27048
- camel.apache.orgCVE-2026-84180, the camel-knative member of the same unmuted-consumer-exception familyhttps://camel.apache.org/security/CVE-2026-84180.html
- camel.apache.orgCVE-2026-85246, the camel-mina member of the same unmuted-consumer-exception familyhttps://camel.apache.org/security/CVE-2026-85246.html
- camel.apache.orgCVE-2026-85257, the camel-cxf member of the same unmuted-consumer-exception familyhttps://camel.apache.org/security/CVE-2026-85257.html
- camel.apache.orgCVE-2026-85315, the camel-grpc member of the same unmuted-consumer-exception familyhttps://camel.apache.org/security/CVE-2026-85315.html
07 Remediation
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The fix adds a muteException consumer option to the coap, coaps, coap+tcp and coaps+tcp endpoints, defaulting to true on all three release lines, so the upgrade is enough on its own and the error response carries no payload without any configuration change. An exception raised while the response is built is answered with an empty 5.00 Internal Server Error and reported through the consumer's exception handler, and a failed exchange, previously answered with 2.05 Content and the body the message held when the route failed, is now answered with 5.00 Internal Server Error under the same rule. Setting muteException=false sends the exception's message as the payload of the 5.00 response, for a route failure as well. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release.