CVE-2026-85251: Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequestInterceptorFirst, and HttpClient runs protocol-level request interceptors inside ProtocolExec, which sits below RedirectExec in the exec chain; the interceptor therefore ran again for every redirect hop and re-attached Authorization: Bearer to whatever host the Location header named. Separately, credentials were registered against an AuthScope matching any host, so basic and digest credentials were presented to a redirect target as well. A remote endpoint - or anyone who can influence its responses - could therefore collect the bearer token or the configured credentials simply by answering with a redirect to a host it controls.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Credentials are now sent only to the authority the endpoint was configured with, and are not re-attached when a redirect crosses to another host. For deployments that cannot upgrade immediately, set followRedirects=false on endpoints that carry credentials, and handle any redirect explicitly in the route so that the destination is chosen by the route rather than by the remote server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.23.0 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.18.5 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.22.1 - Configuration
Set followRedirects=false on endpoints that carry credentials, and handle redirects explicitly in the route so the destination is chosen by the route rather than by the remote server.
Apache Camel HTTP component followRedirects = false
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the Apache Camel HTTP component with followRedirects=true are exposed if they run Apache Camel 4.0.0 through versions before 4.18.5, or 4.19.0 through versions before 4.22.1. The issue affects flows that use OAuth2 bearer tokens or configured basic or digest credentials.
What does an attacker need to exploit this?
An attacker needs to operate the remote endpoint, or be able to influence its HTTP responses, so it can return a redirect whose Location header points to an attacker-controlled host. No authentication or user interaction is required according to the supplied vector.
What information can be disclosed?
A redirect target can receive an OAuth2 Authorization: Bearer token or configured basic or digest credentials. The affected behavior re-attaches or presents those credentials to the host selected by the redirect response.
What can be done if an upgrade cannot happen immediately?
The described exposure depends on followRedirects=true. Avoiding redirects or disabling redirect following where feasible prevents the redirect target from being selected by the remote server in this attack path.
Which versions fix the issue?
Upgrade to Apache Camel 4.23.0. For the 4.18.x LTS stream, upgrade to 4.18.5; for the 4.22.x LTS stream, upgrade to 4.22.1.