CVE-2026-85247 Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore
Attackers can intercept encrypted traffic in Apache Camel Knative when SSL is enabled without a truststore, bypassing certificate validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85247?
CVE-2026-85247 is a medium-severity vulnerability in Apache Camel, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Certificate Validation vulnerability in Apache Camel Knative component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on without also configuring a truststore therefore obtained an encrypted connection with no peer authentication, which an attacker positioned on the network path can terminate and read. The dangerous state is reached by omission rather than by an explicit opt-in, which is what makes it a framework defect: turning TLS on should not be the thing that turns certificate validation off.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. With no truststore configured the trust options are now left unset so the JVM default trust anchors apply, the same fallback SSLContextParameters and the rest of Camel use. Trusting every certificate is now reached only by asking for it explicitly through the trust.all property, which remains available for development against a cluster with a self-signed certificate. For deployments that cannot upgrade immediately, configure a truststore explicitly wherever SSL is enabled. After upgrading, a deployment that was relying on the implicit trust-all behaviour must either configure a truststore or set the trust.all property deliberately.
Weakness: CWE-295
Which versions are affected by CVE-2026-85247?
How do I fix CVE-2026-85247?
No fix has been published for CVE-2026-85247 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85247 being exploited?
There is no known exploitation of CVE-2026-85247 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-5p69-3rq2-6qj8.