CVE-2026-85313: Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the platform-http-vertx advisory published alongside it, in a different component.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly. For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relying on what enableCORS installs, naming the allowed origins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.23.0 - Configuration
Configure the CrossOriginFilter parameters explicitly and name the origins allowed to make cross-origin requests instead of relying on enableCORS defaults.
Jetty CrossOriginFilter allowed origins = explicitly named origins
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use the Camel Jetty component in versions 4.0.0 through 4.18.4 or 4.19.0 through 4.22.0 and have enableCORS set on a Jetty endpoint. Deployments that do not enable CORS are not described as affected.
What does an attacker need to exploit this issue?
An attacker needs a user to interact with a page hosted on an untrusted origin. That page can make credentialed cross-origin requests to the affected endpoint and read its responses because the installed policy accepts every origin and allows credentials.
How can I determine whether a deployment has been exposed?
Review Jetty endpoint configuration for enableCORS and compare the running Camel version with the affected ranges. Any affected-version endpoint with enableCORS enabled used Jetty CrossOriginFilter stock defaults that accepted every origin and allowed credentials.
What should be done if an immediate upgrade is not possible?
Configure the CrossOriginFilter parameters explicitly rather than relying on the defaults installed by enableCORS. Limit accepted origins to the origins intended to access the endpoint.
What upgrade or configuration changes are required?
Upgrade to Apache Camel 4.23.0, or to 4.18.5 on the 4.18.x LTS stream or 4.22.1 on the 4.22.x LTS stream. After upgrading, deployments that intentionally accepted any origin must list their allowed origins explicitly.