CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

As cited

Copy frozen at 2026-10-23 15:37 UTC (site build).

vulnerabilities

CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Apache Camel's AWS2-S3 component contains an expression language injection vulnerability in versions before 4.18.5 and 4.22.2, where untrusted S3 object keys from the CamelAwsS3Key header are evaluated as expressions. An authenticated attacker could exploit this to read sensitive data or modify application behavior.

Why it matters: Organizations running Camel 4.8.0, 4.19.0, or intermediate versions for AWS S3 operations need to upgrade immediately; this is exploitable by any authenticated user without interaction.

Source published

2026-10-23 13:25 UTC

First seen by Cybersecurity Tracker

2026-10-23 14:50 UTC