CVE-2026-43867

{
  "id": "CVE-2026-43867",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-06T09:16:36.057",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component.\n\nThe camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. A principal who can write to the AWS Secrets Manager secret that holds this metadata (requiring secretsmanager:PutSecretValue on that secret) could store a crafted serialized object that is deserialized during normal key-lifecycle operations, potentially leading to code execution in the context of the application that manages the keys. This is the same underlying defect, in the same code path and remediated by the same fix, as CVE-2026-46590, which was reported independently and additionally covers the HashiCorp Vault and file-based sibling managers; both are incomplete-remediation follow-ons to CVE-2026-40048 (CAMEL-23200).\nThis issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, restrict write access to the AWS Secrets Manager secret that holds the camel-pqc key metadata so that only the application’s own identity holds secretsmanager:PutSecretValue on it (least-privilege IAM), and keep the PQC key material in a secret separate from any data that less-trusted principals can write."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de deserialización de datos no confiables en el componente PQC de Apache Camel.\n\nEl componente camel-pqc persiste metadatos de clave post-cuántica (KeyMetadata) a través de implementaciones conectables de KeyLifecycleManager. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() lee esos metadatos del secreto configurado de AWS Secrets Manager decodificando en Base64 el valor almacenado y deserializándolo con un java.io.ObjectInputStream.readObject() sin procesar y sin ObjectInputFilter o lista de permitidos de clases; la conversión a KeyMetadata ocurre solo después de que readObject() retorna, por lo que cualquier efecto secundario de readObject() en un objeto manipulado se ejecuta antes de la verificación de tipo. Un principal que puede escribir en el secreto de AWS Secrets Manager que contiene estos metadatos (requiriendo secretsmanager:PutSecretValue en ese secreto) podría almacenar un objeto serializado manipulado que se deserializa durante las operaciones normales del ciclo de vida de la clave, lo que podría llevar a la ejecución de código en el contexto de la aplicación que gestiona las claves. Este es el mismo defecto subyacente, en la misma ruta de código y remediado por la misma corrección, que CVE-2026-46590, que fue reportado independientemente y adicionalmente cubre los gestores hermanos basados en HashiCorp Vault y en archivos; ambos son seguimientos de remediación incompleta de CVE-2026-40048 (CAMEL-23200).\nEste problema afecta a Apache Camel: desde 4.18.0 antes de 4.18.3, desde 4.19.0 antes de 4.21.0.\n\nSe recomienda a los usuarios actualizar a la versión 4.21.0, que corrige el problema. Si los usuarios están en la rama de versiones LTS 4.18.x, se les sugiere actualizar a 4.18.3. Para implementaciones que no pueden actualizarse inmediatamente, restrinja el acceso de escritura al secreto de AWS Secrets Manager que contiene los metadatos de clave de camel-pqc de modo que solo la propia identidad de la aplicación tenga secretsmanager:PutSecretValue sobre él (IAM de mínimo privilegio), y mantenga el material de clave PQC en un secreto separado de cualquier dato que los principales menos confiables puedan escribir."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Camel",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.camel:camel-pqc",
          "versions": [
            {
              "version": "4.18.0",
              "lessThan": "4.18.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.19.0",
              "lessThan": "4.21.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T19:27:13.344138Z",
          "id": "CVE-2026-43867",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.18.0",
              "versionEndExcluding": "4.18.3",
              "matchCriteriaId": "3F672322-AA52-4621-B687-76B5AC9D619F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.19.0",
              "versionEndExcluding": "4.21.0",
              "matchCriteriaId": "1C2A1A7A-FADC-470F-8265-FA126AFD94ED"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://camel.apache.org/security/CVE-2026-43867.html",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}