{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-85247 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-85247 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-85247 is a medium-severity vulnerability in Apache Camel, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-85247 and fix it if it is affected.\n\nWhat it is: CVE-2026-85247 is a medium-severity vulnerability in Apache Camel, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-85247 in the wild and no public exploit code.\n\nAffected product: Apache Camel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-85247/ (Markdown: https://insights.sbomify.com/CVE-2026-85247/index.md)","id":"CVE-2026-85247","markdown":"https://insights.sbomify.com/CVE-2026-85247/index.md","name":"CVE-2026-85247","record":{"aliases":["GHSA-5p69-3rq2-6qj8"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Apache Camel library","requires_auth":"none","summary":"Attackers can intercept encrypted traffic in Apache Camel Knative when SSL is enabled without a truststore, bypassing certificate validation.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[],"cvss":{"score":5.9,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-295","name":"Improper Certificate Validation"}],"description":"Improper Certificate Validation vulnerability in Apache Camel Knative component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWhen SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on without also configuring a truststore therefore obtained an encrypted connection with no peer authentication, which an attacker positioned on the network path can terminate and read. The dangerous state is reached by omission rather than by an explicit opt-in, which is what makes it a framework defect: turning TLS on should not be the thing that turns certificate validation off.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. With no truststore configured the trust options are now left unset so the JVM default trust anchors apply, the same fallback SSLContextParameters and the rest of Camel use. Trusting every certificate is now reached only by asking for it explicitly through the trust.all property, which remains available for development against a cluster with a self-signed certificate. For deployments that cannot upgrade immediately, configure a truststore explicitly wherever SSL is enabled. After upgrading, a deployment that was relying on the implicit trust-all behaviour must either configure a truststore or set the trust.all property deliberately.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-10-19","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-19T11:45:14Z","kind":"github_poc","ref":"https://github.com/oscerd/CVE-2026-85247","stars":0,"title":"Reproducer for CVE-2026-85247 — Apache Camel camel-knative improper certificate validation (CWE-295); Spring Boot + Quarkus, affected vs fixed"}],"tier":"poc_unverified"},"has_fix":false,"headline":"Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore","id":"CVE-2026-85247","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance","id":"CVE-2026-85248"},"packages":[],"prev":{"headline":"Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions","id":"CVE-2026-85246"},"products":["Apache Camel"],"published":"2026-10-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Apache Software Foundation"]},"summary":"Attackers can intercept encrypted traffic in Apache Camel Knative when SSL is enabled without a truststore, bypassing certificate validation.","url":"https://insights.sbomify.com/CVE-2026-85247/"}