CVE-2026-27172

highpriority · track · 10EPSS 0.012 · 69 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

1.23% (69th) EPSS

CVSS 8.8 · high

Is it mine?

23 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs. This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1. Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.3–8.8

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 5.9

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · OSV

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502USCWE-502USCWE-502US

exploits (1)

Public proof-of-concept and weaponised exploit code.

oscerd/CVE-2026-27172Reproducer for CVE-2026-27172: Apache Camel camel-consul ConsulRegistry Java deserialization (RCE)PoC · poc_in_github

affected products (23)

Products and version ranges known to be affected.

Apache Camel <4.14.6all versionscert_bundDE
Apache Camel <4.18.1all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Apache Camel for Spring Bootall versionscert_bundDEcpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot
Apache Camel< 4.14.6cert_bundDE
Apache Camel< 4.18.1cert_bundDE
Apache Software Foundation Apache Camel3.0.0 → 4.14.6enisa_euvdEU
Apache Software Foundation Apache Camel4.15.0 → 4.18.1enisa_euvdEU
Apache Software Foundation Camel≤ 4.19.0fstec_bduRU
Apache Software Foundation Camel3.0.0 → 4.14.6fstec_bduRU
Apache Software Foundation Camel4.15.0 → 4.18.1fstec_bduRU
Apache Camel≤ vers:unknown/*ncsc_nlNL
Apache Software Foundation Apache Camel≤ vers:unknown/*ncsc_nlNL
Apache Software Foundation Apache Camel CoAP≤ vers:unknown/*ncsc_nlNL
Apache Software Foundation Apache Camel Google PubSub≤ vers:unknown/*ncsc_nlNL
Apache Software Foundation Apache Camel JMS≤ vers:unknown/*ncsc_nlNL
Apache Software Foundation Apache Camel Mina≤ vers:unknown/*ncsc_nlNL
Apache Software Foundation Apache Camel PQC≤ vers:unknown/*ncsc_nlNL
Apache Software Foundation Apache Camel Platform HTTP Main≤ vers:unknown/*ncsc_nlNL
apache camel3.0.0 → 4.14.6nvdUScpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*

showing 20 of 23

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0129Kwetsbaarheden verholpen in Apache CamelNL2026-04-29csaf · ncsc_nlNL
Apache Software Foundation heeft kwetsbaarheden verholpen in Apache Camel.
WID-SEC-W-2026-1271Apache Camel: Mehrere SchwachstellenDeutsch2026-04-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.
GHSA-5rc6-9qfp-8vwgApache Camel-Consul component vulnerable to Deserialization of Untrusted Data2026-04-27ghsa · osvUS
The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs. This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1. Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl nvd osv NVD CVE.org MITRE

published 2026-04-27modified 2026-10-26

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan