CVE-2026-85315

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status description. Unlike the status cause, which stays local to the server, the description is transmitted to the calling client, so an external caller able to provoke a failure could read the internal error message. What that discloses depends on the exception, and in practice includes class and package names, paths, host names and connection detail carried in messages. This is the gRPC member of the same unmuted-consumer-exception family as the knative, mina and CXF advisories published alongside it. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. A muteException consumer option, defaulting to true, puts a generic description in the status instead of the route exception's message. Set muteException=false to restore the previous output. For deployments that cannot upgrade immediately, map failures onto an explicit status in an onException handler so the framework never copies the exception message into the description.

• CWE-209

• https://camel.apache.org/security/CVE-2026-85315.html
• https://github.com/apache/camel/pull/25839
• https://github.com/apache/camel/pull/25934
• https://github.com/apache/camel/pull/25935
• https://issues.apache.org/jira/browse/CAMEL-24478

Published

Oct 19, 2026

Last Modified

Oct 19, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8531Heap buffer overflow in WebML in Google Chrome on Windows pr…8.8
• CVE-2026-85310import_contacts Path Traversal in Groundhogg <= 4.7.1 versio…6.5
• CVE-2026-85311Missing Authorization vulnerability in Kings Plugins MarketK…5.3
• CVE-2026-85312Improper Input Validation vulnerability in Apache Camel Core…4.8
• CVE-2026-85313Permissive Cross-domain Policy with Untrusted Domains vulner…4.3
• CVE-2026-85314Improper Input Validation vulnerability in Apache Camel Mail…6.5
• CVE-2026-85316Insufficient Granularity of Access Control vulnerability in …4.8
• CVE-2026-85317Use of Cache Containing Sensitive Information vulnerability …4.8
• CVE-2026-85318Heap-based buffer overflow in Servicing Stack Updates allows…7.8
• CVE-2026-85319Allocation of resources without limits or throttling in Acti…7.5
• CVE-2026-8532Integer overflow in XML in Google Chrome prior to 148.0.7778…8.8
• CVE-2026-85320Use of uninitialized resource in Windows Print Spooler Compo…5.5