CVE-2026-40048

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2. Users are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2.

• CWE-502
• CWE-502

• https://camel.apache.org/security/CVE-2026-40048.htmlVendor Advisory
• http://www.openwall.com/lists/oss-security/2026/04/26/6Mailing List, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-40048
• https://bugzilla.redhat.com/show_bug.cgi?id=2463176
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40048.json

Published

Apr 27, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40042Pachno 1.0.6 contains an XML external entity injection vulne…9.8
• CVE-2026-40043Pachno 1.0.6 contains an authentication bypass vulnerability…7.1
• CVE-2026-40044Pachno 1.0.6 contains a deserialization vulnerability that a…9.8
• CVE-2026-40045OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:/…5.9
• CVE-2026-40046Integer Overflow or Wraparound vulnerability in Apache Activ…7.5
• CVE-2026-40047Improper Neutralization of Argument Delimiters in a Command …9.1
• CVE-2026-4005The Coachific Shortcode plugin for WordPress is vulnerable t…6.4
• CVE-2026-40050CrowdStrike has released security updates to address a criti…9.8
• CVE-2026-4006The Simple Draft List plugin for WordPress is vulnerable to …6.4
• CVE-2026-40060When a BIG-IP Advanced WAF or ASM security policy is configu…8.7
• CVE-2026-40061When BIG-IP DNS is provisioned, a vulnerability exists in an…8.7
• CVE-2026-40062A path Traversal vulnerability exists in Ziostation2 v2.9.8.…8.7