{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-88900 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-88900 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-88900 is a high-severity unsafe deserialization vulnerability in Apache Camel, published on 19 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-88900 and fix it if it is affected.\n\nWhat it is: CVE-2026-88900 is a high-severity unsafe deserialization vulnerability in Apache Camel, published on 19 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-88900 in the wild and no public exploit code.\n\nAffected product: Apache Camel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-88900/ (Markdown: https://insights.sbomify.com/CVE-2026-88900/index.md)","id":"CVE-2026-88900","markdown":"https://insights.sbomify.com/CVE-2026-88900/index.md","name":"CVE-2026-88900","record":{"aliases":["GHSA-wqmw-6vq7-3mxp"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Apache Camel JGroups","requires_auth":"none","summary":"Remote attackers can execute arbitrary code in Apache Camel applications by sending crafted serialized objects via the JGroups consumer without authentication.","user_interaction":"not_required","vuln_class":"deserialization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"description":"Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nJGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an ObjectMessage, which is the message type the Camel jgroups producer sends, JGroups Java-deserializes the payload through an ObjectInputStream on its own receive thread as the message arrives, and getObject() returns the resulting object. No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is configured, the consumer creates its channel with new JChannel(), the stock JGroups protocol stack, which multicasts over UDP without the AUTH protocol and without encryption, so any host able to reach the cluster's multicast group or bind port can join the cluster and send messages to the consumer without credentials. Such a host could send a crafted serialized object that leads to remote code execution in the Camel process when a usable deserialization gadget chain is present on the classpath, and no non-default option was required on the consumer. Because JGroups materializes the object before Camel's receiver runs, a check performed by Camel can only inspect the deserialized result and cannot stop code that runs during deserialization, so closing the issue also requires a control that applies before the payload is read, as described in the mitigation. Exploitation requires network access to the cluster's multicast group or bind port, which with the default UDP multicast transport means a host on an adjacent network, and a usable gadget chain on the classpath, which is why the severity is assessed as high rather than critical.\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-10-21","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-21T09:49:17Z","kind":"github_poc","ref":"https://github.com/oscerd/CVE-2026-88900","stars":0,"title":"Reproducer for CVE-2026-88900 — Apache Camel camel-jgroups unsafe Java deserialization of cluster messages (CWE-502, HIGH). Camel Spring Boot."}],"tier":"poc_unverified"},"has_fix":false,"headline":"Deserialization in Apache Camel","id":"CVE-2026-88900","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"deserialization","year":"2026"},"n_packages":0,"n_references":10,"next":{"headline":"Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default","id":"CVE-2026-88901"},"packages":[],"prev":{"headline":"knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header","id":"CVE-2026-88899"},"products":["Apache Camel"],"published":"2026-10-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-20","vendors":["Apache Software Foundation"]},"summary":"Remote attackers can execute arbitrary code in Apache Camel applications by sending crafted serialized objects via the JGroups consumer without authentication.","url":"https://insights.sbomify.com/CVE-2026-88900/"}