CVE-2026-85296: Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
Signing material belonging to an individual request was stored in state that is shared across requests rather than confined to the request being processed. Where a deployment serves more than one trading partner, concurrent or successive requests could therefore observe each other's material, and a Message Disposition Notification could be signed with the key of a partner other than the one the receipt was for. The result is cross-partner key confusion: a receipt attributable to the wrong partner, and one partner's signing material used while handling another partner's exchange. AS2 deployments are typically multi-partner by design, so the condition is reached by ordinary concurrent traffic rather than by anything the attacker must arrange.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Per-request signing keys are now confined to the request being processed in ResponseMDN. For deployments that cannot upgrade immediately, run a separate Camel context per trading partner so that no signing material is shared between them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.23.0 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.18.5 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.22.1 - Compensating control
For deployments that cannot upgrade immediately, run a separate Camel context per trading partner so that no signing material is shared between them.
Event History
Frequently Asked Questions
Which deployments are exposed to cross-partner key confusion?
Apache Camel AS2 deployments serving more than one trading partner are exposed in affected versions. The condition can occur during ordinary concurrent or successive traffic; it does not require an attacker to arrange unusual request patterns.
Does exploitation require authentication or user interaction?
No privileges or user interaction are required according to the provided CVSS vector. Exploitation has high attack complexity, but is network-reachable.
What is the impact of a successful occurrence?
A Message Disposition Notification can be signed using a different partner's signing key, making the receipt attributable to the wrong partner. One partner's signing material may be used while another partner's exchange is processed.
Which versions should be upgraded?
Upgrade to Apache Camel 4.23.0. For the 4.18.x LTS stream, upgrade to 4.18.5; for the 4.22.x LTS stream, upgrade to 4.22.1.