CVE-2026-43867 Overview
CVE-2026-43867 is an insecure deserialization vulnerability in the Apache Camel post-quantum cryptography (PQC) component. The camel-pqc component persists KeyMetadata through pluggable KeyLifecycleManager implementations. The AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() method reads that metadata back from AWS Secrets Manager, Base64-decodes the stored value, and passes it to java.io.ObjectInputStream.readObject() without any ObjectInputFilter or class allow-list. A principal with write access to the secret can plant a crafted serialized object that executes attacker-controlled code when the Camel application performs a normal key-lifecycle operation.
Critical Impact
An attacker with secretsmanager:PutSecretValue on the metadata secret can achieve arbitrary code execution in the Apache Camel process that manages PQC keys.
Affected Products
- Apache Camel 4.18.0 through versions before 4.18.3 (LTS stream)
- Apache Camel 4.19.0 through versions before 4.21.0
- Deployments using the camel-pqc component with AwsSecretsManagerKeyLifecycleManager
Discovery Timeline
- 2026-07-06 - CVE-2026-43867 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-43867
Vulnerability Analysis
The defect resides in the camel-pqc component, which manages post-quantum key material through pluggable KeyLifecycleManager implementations. The AWS Secrets Manager backend serializes KeyMetadata objects into a secret value and reads them back during normal key-lifecycle operations. On the read path, deserializeMetadata() Base64-decodes the stored blob and invokes ObjectInputStream.readObject() on the raw bytes.
The cast to KeyMetadata occurs only after readObject() returns. Any Java gadget chain reachable on the application classpath executes during deserialization, well before the type check runs. Common gadget chains from libraries like Commons Collections, Spring, or Groovy can achieve remote code execution in this scenario [CWE-502].
This is the same underlying defect as CVE-2026-46590, which additionally covers the HashiCorp Vault and file-based sibling managers. Both are incomplete-remediation follow-ons to CVE-2026-40048 (CAMEL-23200).
Root Cause
The root cause is the use of a raw ObjectInputStream without a configured ObjectInputFilter or class allow-list. Java serialization treats any incoming byte stream as trusted, allowing arbitrary object graphs to be reconstructed. The developer's assumption that only the application writes the secret creates an implicit trust boundary that IAM misconfigurations or compromised writers can break.
Attack Vector
An attacker who obtains secretsmanager:PutSecretValue on the specific secret holding camel-pqc metadata writes a Base64-encoded, crafted serialized payload. On the next key-lifecycle operation, the Camel application fetches and deserializes the payload, executing the embedded gadget chain in the process context.
The vulnerability manifests entirely within the deserialization call path. See the Apache Camel CVE-2026-43867 Advisory for the vendor's technical description.
Detection Methods for CVE-2026-43867
Indicators of Compromise
- Unexpected PutSecretValue API calls in AWS CloudTrail against secrets used by camel-pqc, especially from principals that are not the Camel application's own IAM role.
- Anomalous child processes spawned by the JVM running Apache Camel shortly after key-lifecycle operations.
- Outbound network connections from the Camel process to unknown hosts following a secret update event.
Detection Strategies
- Enable AWS CloudTrail data events for Secrets Manager and alert on any PutSecretValue where the source principal differs from the Camel application role.
- Inspect Camel application logs for exceptions thrown by AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() or ClassCastException on KeyMetadata, which may indicate failed exploitation attempts.
- Deploy runtime application self-protection or Java agents that flag ObjectInputStream.readObject() calls resolving non-KeyMetadata classes.
Monitoring Recommendations
- Correlate IAM policy changes granting secretsmanager:PutSecretValue with subsequent secret writes and Camel restart events.
- Baseline the JVM process tree for the Camel application and alert on new child processes such as sh, bash, cmd.exe, or powershell.exe.
- Track EPSS trend data for CVE-2026-43867 and prioritize patching if exploit code becomes publicly available.
How to Mitigate CVE-2026-43867
Immediate Actions Required
- Upgrade Apache Camel to version 4.21.0, or to 4.18.3 for LTS deployments, which remediate the deserialization defect.
- Audit every IAM principal that holds secretsmanager:PutSecretValue on secrets consumed by camel-pqc and revoke access that is not strictly required.
- Rotate any PQC key metadata secrets that may have been written by non-application principals.
Patch Information
Apache has released fixed versions 4.18.3 and 4.21.0. Refer to the Apache Camel CVE-2026-43867 Advisory for exact artifact coordinates and release notes.
Workarounds
- Restrict write access to the AWS Secrets Manager secret holding camel-pqc key metadata so that only the application's own identity holds secretsmanager:PutSecretValue.
- Keep the PQC key material in a secret separate from any data that less-trusted principals can write.
- Enable AWS Secrets Manager resource policies that explicitly deny writes from principals outside the Camel application's IAM role.
# Example AWS CLI check: list principals with write access to the PQC secret
aws secretsmanager get-resource-policy \
--secret-id camel-pqc/key-metadata
# Upgrade Camel via Maven (pom.xml)
# <dependency>
# <groupId>org.apache.camel</groupId>
# <artifactId>camel-pqc</artifactId>
# <version>4.21.0</version>
# </dependency>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
