8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27172

CVE-2026-27172: Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data

The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs.

This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1.

Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27172

CVE-2026-27172:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.camel:camel-consul	maven	>= 3.0.0, < 4.14.6	4.14.6
org.apache.camel:camel-consul	maven	>= 4.15.0, < 4.18.1	4.18.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the camel-consul component of Apache Camel and is due to the insecure deserialization of data retrieved from a Consul Key-Value store. The root cause is in the org.apache.camel.component.consul.ConsulRegistry.ConsulRegistryUtils.deserialize method, which uses ObjectInputStream.readObject() without any filtering mechanism to prevent the deserialization of malicious objects.

The primary attack vector involves an attacker with write access to the Consul KV store used by a Camel application. The attacker can store a specially crafted serialized Java object (a gadget chain) in the KV store. When the Camel application performs a lookup for this key using the org.apache.camel.component.consul.ConsulRegistry.lookupByName method, the stored value is fetched and passed to the vulnerable deserialize method. This triggers the deserialization of the malicious object, leading to arbitrary code execution on the server running the Camel application.

The patch mitigates this vulnerability by introducing an ObjectInputFilter. The deserialize method is updated to accept a filter string, which is then used to configure the ObjectInputStream. This filter restricts which classes are allowed to be deserialized, preventing the execution of malicious gadget chains. By default, the filter allows classes from the java.** and org.apache.camel.** packages, while blocking all others.

Vulnerable functions

org.apache.camel.component.consul.ConsulRegistry.ConsulRegistryUtils.deserialize

components/camel-consul/src/main/java/org/apache/camel/component/consul/ConsulRegistry.java

This function is vulnerable because it deserializes a byte array using `ObjectInputStream.readObject()` without an `ObjectInputFilter`. An attacker can craft a malicious serialized object which, when deserialized by this function, can lead to arbitrary code execution.

org.apache.camel.component.consul.ConsulRegistry.lookupByName

components/camel-consul/src/main/java/org/apache/camel/component/consul/ConsulRegistry.java

This function retrieves a value from the Consul KV store, decodes it, and then passes it to the vulnerable `deserialize` method. This is the primary entry point for the vulnerability, as an attacker who can write to the Consul KV store can have their malicious payload deserialized when this lookup function is called.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.