CVE-2026-6857 Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization
A remote attacker can achieve arbitrary code execution and full system control via unsafe deserialization in the ProtoStream remote aggregation repository.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6857?
CVE-2026-6857 is a high-severity unsafe deserialization vulnerability in Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, published on 22 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
Weakness: CWE-502
Which versions are affected by CVE-2026-6857?
2 open source packages ship an affected version, including org.apache.camel:camel-infinispan.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.camel:camel-infinispan Maven | All versions | 4.20.0 |
org.apache.camel:camel-infinispan Maven | All versions | 4.20.0 |
How do I fix CVE-2026-6857?
Upgrade org.apache.camel:camel-infinispan to 4.20.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-6857 being exploited?
There is no known exploitation of CVE-2026-6857 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-xfxp-ppx7-cqrp.