CVE-2026-46590: Apache Camel RCE Vulnerability

CVE-2026-46590 Overview

CVE-2026-46590 is a deserialization of untrusted data vulnerability [CWE-502] in the Apache Camel camel-pqc component. The flaw exists in the HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and FileBasedKeyLifecycleManager classes, which read post-quantum key metadata using a raw java.io.ObjectInputStream.readObject() call without an ObjectInputFilter or class allow-list. A principal with write access to the configured secret backend can store a crafted serialized object that triggers code execution during normal key-lifecycle operations.

Critical Impact

An attacker with write access to the HashiCorp Vault KV path or the AWS Secrets Manager secret backing the PQC key store can achieve code execution in the context of the Camel application managing the keys.

Affected Products

• Apache Camel 4.18.0 through 4.18.2
• Apache Camel 4.19.0 through 4.20.x
• camel-pqc component (HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, FileBasedKeyLifecycleManager)

Discovery Timeline

• 2026-07-06 - CVE-2026-46590 published to NVD
• 2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-46590

Vulnerability Analysis

The camel-pqc component persists post-quantum KeyMetadata through pluggable KeyLifecycleManager implementations. When reading metadata back from the secret backend, the affected managers Base64-decode the stored value and pass it directly to ObjectInputStream.readObject(). The subsequent cast to KeyMetadata occurs only after readObject() returns, so any gadget chain side effects execute before the type check runs.

The issue is an incomplete remediation of CVE-2026-40048 (CAMEL-23200). That earlier fix changed FileBasedKeyLifecycleManager to store metadata as JSON, PKCS#8, and X.509, but did not add an ObjectInputFilter, did not cover the Vault and AWS sibling managers, and left the legacy-migration deserialization path in FileBasedKeyLifecycleManager unfiltered.

Root Cause

The root cause is the use of an unfiltered Java native deserialization primitive on data sourced from a mutable external backend. Without an ObjectInputFilter or class allow-list, the JVM will materialize any serializable class present on the classpath, including classes that expose gadget chains such as those in commonly bundled Apache Commons Collections or other transitive dependencies.

Attack Vector

Exploitation requires write authority to the operator-controlled secret store that holds the PQC key metadata. For the Vault manager, this means a token authorized to write the relevant KV path. For the AWS manager, it requires secretsmanager:PutSecretValue on the target secret. Once the attacker writes a crafted Base64-wrapped serialized payload, the next key-lifecycle read triggers deserialization and executes the gadget chain inside the Camel process.

No verified public proof-of-concept code is available. The vulnerability mechanism follows the standard Java deserialization gadget-chain pattern, where objects with side-effecting readObject, readResolve, or finalize implementations are chained to achieve arbitrary command execution during graph reconstruction.

Detection Methods for CVE-2026-46590

Indicators of Compromise

• Unexpected writes to HashiCorp Vault KV paths or AWS Secrets Manager secrets storing camel-pqc metadata, especially by identities other than the Camel application itself.
• Base64-decoded secret values that contain the Java serialization magic bytes AC ED 00 05 rather than JSON, PKCS#8, or X.509 structures.
• Child processes spawned by the Camel JVM shortly after a key-lifecycle read operation.

Detection Strategies

• Enable Vault audit logging and AWS CloudTrail PutSecretValue events, and alert on writers that are not the Camel application's own IAM role or Vault identity.
• Inspect stored PQC secret payloads and flag any value whose Base64 decoding begins with the Java serialized-object header.
• Monitor Camel JVMs for anomalous process execution, outbound connections, or class-loading events originating from ObjectInputStream.readObject frames.

Monitoring Recommendations

• Correlate secret-store write events with subsequent restarts or key-lifecycle operations of Camel workloads.
• Track deserialization exceptions and ClassCastException events in Camel application logs, which may indicate failed exploitation attempts.
• Alert on runtime loading of known gadget classes (for example, InvokerTransformer) inside the Camel process.

How to Mitigate CVE-2026-46590

Immediate Actions Required

• Upgrade Apache Camel to 4.21.0, or to 4.18.3 for the 4.18.x LTS stream.
• Rotate any Vault tokens or AWS IAM credentials that had write access to the PQC secret backend during the exposure window.
• Audit HashiCorp Vault KV paths and AWS Secrets Manager entries used by camel-pqc for unexpected Base64-serialized payloads and revert any suspicious values.

Patch Information

Apache Camel 4.21.0 and 4.18.3 add filtered deserialization and complete the remediation started in CVE-2026-40048 by covering the Vault, AWS, and FileBasedKeyLifecycleManager legacy-migration paths. See the Apache Camel CVE-2026-46590 Advisory for full remediation details.

Workarounds

• Restrict write access to the PQC secret backend so only the Camel application's own identity can write camel-pqc secrets, using least-privilege HashiCorp Vault policies and narrowly scoped secretsmanager:PutSecretValue IAM statements.
• Store PQC key material in a dedicated backend that is isolated from any secret store writable by less-trusted principals.
• Where feasible, set a JVM-wide jdk.serialFilter allow-list that rejects classes outside the expected KeyMetadata and KeyPair types.

# Example JVM-wide deserialization allow-list for Camel workloads
-Djdk.serialFilter="org.apache.camel.component.pqc.**;java.lang.*;java.util.*;java.security.*;!*"