CVE-2026-40860: Apache Camel JMS RCE Vulnerability

CVE-2026-40860 Overview

CVE-2026-40860 is a critical insecure deserialization vulnerability affecting Apache Camel's JMS binding components. The vulnerability exists in JmsBinding.extractBodyFromJms() within the camel-jms module and its equivalent class in camel-sjms, where incoming JMS ObjectMessage payloads are deserialized via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist, or class denylist. When exploited, this vulnerability allows remote attackers to achieve arbitrary code execution on affected systems.

Critical Impact

Remote attackers can achieve arbitrary code execution by publishing crafted ObjectMessage payloads to JMS queues or topics consumed by vulnerable Apache Camel applications when a deserialization gadget chain is present on the classpath.

Affected Products

• Apache Camel from 3.0.0 before 4.14.7
• Apache Camel from 4.15.0 before 4.18.2
• Apache Camel 4.19.0 before 4.20.0

Discovery Timeline

• April 27, 2026 - CVE-2026-40860 published to NVD
• April 28, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40860

Vulnerability Analysis

This insecure deserialization vulnerability (CWE-502) affects the JMS message processing functionality in Apache Camel. The vulnerability manifests in how Camel handles incoming JMS ObjectMessage values when the mapJmsMessage option is enabled, which is the default configuration. The core issue lies in the JmsBinding.extractBodyFromJms() method, which directly deserializes message payloads using javax.jms.ObjectMessage.getObject() without implementing any security controls to filter or validate the classes being instantiated during deserialization.

The vulnerability's reach extends beyond the directly affected components. The same vulnerable code path is accessible transitively through camel-sjms2 (where Sjms2Endpoint extends SjmsEndpoint), camel-amqp (where AMQPJmsBinding extends JmsBinding), and other JMS-family components built on JmsComponent such as camel-activemq and camel-activemq6.

Root Cause

The root cause is the absence of deserialization security controls in the JMS message binding layer. When processing incoming ObjectMessage payloads, the code directly invokes getObject() without implementing an ObjectInputFilter, maintaining a class allowlist, or enforcing a class denylist. This allows arbitrary Java objects to be instantiated during the deserialization process, which can lead to remote code execution when common deserialization gadget chains (such as those in Apache Commons Collections, Spring, or other libraries) are present on the application's classpath.

Attack Vector

The attack requires network access to publish messages to JMS queues or topics that are consumed by a vulnerable Apache Camel application. An attacker must craft a malicious ObjectMessage containing a serialized Java object designed to exploit a deserialization gadget chain present on the target system's classpath. When Camel processes this message with the default mapJmsMessage option enabled, the malicious payload is deserialized, triggering the gadget chain and executing arbitrary code with the privileges of the Camel application.

The vulnerability is exploitable without authentication if the attacker has access to publish messages to the target JMS infrastructure. Common attack scenarios include environments where JMS brokers are exposed to untrusted networks or where internal users have message publishing capabilities.

Detection Methods for CVE-2026-40860

Indicators of Compromise

• Unexpected or anomalous messages appearing in JMS queues or topics consumed by Camel applications
• Unusual process spawning or network connections originating from Camel application processes
• Serialized Java objects containing known gadget chain classes in JMS message payloads
• Application crashes or unexpected exceptions related to deserialization activities

Detection Strategies

• Monitor JMS message traffic for ObjectMessage types containing suspicious serialized payloads
• Implement logging and alerting on deserialization exceptions or classloading anomalies in Camel applications
• Deploy network intrusion detection signatures for known Java deserialization attack patterns
• Audit application classpaths for common deserialization gadget chain libraries

Monitoring Recommendations

• Enable verbose logging for JMS message processing in Camel applications to capture message metadata
• Implement application performance monitoring to detect unusual CPU or memory consumption patterns indicative of exploitation
• Configure alerts for unexpected outbound network connections from Camel application servers
• Review JMS broker access logs for unauthorized message publishing activity

How to Mitigate CVE-2026-40860

Immediate Actions Required

• Upgrade Apache Camel to version 4.20.0 or later immediately
• For organizations on the 4.14.x LTS release stream, upgrade to version 4.14.7
• For organizations on the 4.18.x release stream, upgrade to version 4.18.2
• Audit all Camel applications for JMS component usage and prioritize patching accordingly

Patch Information

Apache has released patched versions that address this vulnerability. Users should upgrade to one of the following versions based on their release stream:

For detailed patch information and release notes, refer to the Apache Camel CVE-2026-40860 Advisory.

Workarounds

• Restrict network access to JMS brokers to prevent untrusted parties from publishing messages
• Disable the mapJmsMessage option if ObjectMessage processing is not required for your use case
• Implement network segmentation to isolate JMS infrastructure from untrusted networks
• Remove unnecessary deserialization gadget chain libraries from the application classpath where possible

# Example: Disable mapJmsMessage in Camel route configuration
# In application.properties or equivalent configuration
camel.component.jms.map-jms-message=false