CVE-2026-85247: Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore
Improper Certificate Validation vulnerability in Apache Camel Knative component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on without also configuring a truststore therefore obtained an encrypted connection with no peer authentication, which an attacker positioned on the network path can terminate and read. The dangerous state is reached by omission rather than by an explicit opt-in, which is what makes it a framework defect: turning TLS on should not be the thing that turns certificate validation off.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. With no truststore configured the trust options are now left unset so the JVM default trust anchors apply, the same fallback SSLContextParameters and the rest of Camel use. Trusting every certificate is now reached only by asking for it explicitly through the trust.all property, which remains available for development against a cluster with a self-signed certificate. For deployments that cannot upgrade immediately, configure a truststore explicitly wherever SSL is enabled. After upgrading, a deployment that was relying on the implicit trust-all behaviour must either configure a truststore or set the trust.all property deliberately.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camel Knative componentto a version that resolves this vulnerability.Fixed in 4.23.0 - Upgrade
Upgrade
Apache Camel Knative componentto a version that resolves this vulnerability.Fixed in 4.18.5 - Upgrade
Upgrade
Apache Camel Knative componentto a version that resolves this vulnerability.Fixed in 4.22.1 - Configuration
Configure a truststore explicitly wherever SSL is enabled, especially for deployments that cannot upgrade immediately.
Apache Camel Knative HTTP client truststore = explicitly configured - Configuration
After upgrading, explicitly set the trust.all property only when deliberately choosing to trust every certificate, such as for development against a cluster with a self-signed certificate.
Apache Camel Knative HTTP client trust.all = explicitly set
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache Camel Knative deployments using affected Camel versions are exposed when SSL is enabled on the Knative HTTP client and no truststore is configured. The affected ranges are 4.0.0 through versions before 4.18.5, and 4.19.0 through versions before 4.22.1.
What does an attacker need to exploit the issue?
An attacker must be positioned on the network path between the Knative HTTP client and its peer. In the affected configuration, they can present an arbitrary certificate, terminate the TLS connection, and read its contents.
Are deployments with TLS enabled affected by default?
TLS-enabled deployments are affected only if the Knative HTTP client has no truststore configured. In that state, affected versions trust every presented certificate instead of using the JVM default trust anchors.
What should we do if a truststore is not configured?
Upgrade to Apache Camel 4.23.0, or to 4.18.5 for the 4.18.x LTS stream or 4.22.1 for the 4.22.x LTS stream. The fixed versions leave trust options unset when no truststore is configured, causing the JVM default trust anchors to be used.