{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-85313",
        "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "state": "PUBLISHED",
        "assignerShortName": "apache",
        "dateReserved": "2026-09-03T16:43:32.647Z",
        "datePublished": "2026-10-19T10:40:58.206Z",
        "dateUpdated": "2026-10-19T14:33:28.013Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
                "shortName": "apache",
                "dateUpdated": "2026-10-19T10:40:58.206Z"
            },
            "title": "Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "description": "CWE-942 Permissive Cross-domain Policy with Untrusted Domains",
                            "lang": "en",
                            "cweId": "CWE-942",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "source": {
                "discovery": "UNKNOWN"
            },
            "affected": [
                {
                    "vendor": "Apache Software Foundation",
                    "product": "Apache Camel",
                    "collectionURL": "https://repo.maven.apache.org/maven2",
                    "packageName": "org.apache.camel:camel-jetty",
                    "packageURL": "pkg:maven/org.apache.camel/camel-jetty",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "4.0.0",
                            "lessThan": "4.18.5",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "4.19.0",
                            "lessThan": "4.22.1",
                            "versionType": "maven"
                        },
                        {
                            "status": "unaffected",
                            "version": "4.18.5",
                            "versionType": "maven"
                        },
                        {
                            "status": "unaffected",
                            "version": "4.22.1",
                            "versionType": "maven"
                        },
                        {
                            "status": "unaffected",
                            "version": "4.23.0",
                            "versionType": "maven"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "value": "Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nSetting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the platform-http-vertx advisory published alongside it, in a different component.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly. For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relying on what enableCORS installs, naming the allowed origins.",
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.<br><br>This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.<br><br>Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and allow credentials. An operator asking for CORS therefore obtained a policy that lets a page on any origin make credentialed cross-origin requests to the endpoint and read the responses, without any indication that turning the option on had chosen an allow-all policy rather than an empty one to be filled in. This is the same defect class as the platform-http-vertx advisory published alongside it, in a different component.<br><br>Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly. For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relying on what enableCORS installs, naming the allowed origins.</p>"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://camel.apache.org/security/CVE-2026-85313.html",
                    "name": "Apache Camel Security Advisory - CVE-2026-85313",
                    "tags": [
                        "vendor-advisory"
                    ]
                },
                {
                    "url": "https://issues.apache.org/jira/browse/CAMEL-24450",
                    "name": "CAMEL-24450",
                    "tags": [
                        "issue-tracking"
                    ]
                },
                {
                    "url": "https://github.com/apache/camel/pull/25829",
                    "name": "Fix on main, released in 4.23.0 (commit 6e3e4ec510b4966c70ad99b3c032e27d6adbef9d)",
                    "tags": [
                        "patch"
                    ]
                },
                {
                    "url": "https://github.com/apache/camel/pull/25937",
                    "name": "Backport to camel-4.22.x, released in 4.22.1 (commit b0399b181d26cd8b136fa98b54ec8e5c283338da)",
                    "tags": [
                        "patch"
                    ]
                },
                {
                    "url": "https://github.com/apache/camel/pull/25938",
                    "name": "Backport to camel-4.18.x, released in 4.18.5 (commit e23332aec12f7ec3a841e52d1821e2a580c2fbc7)",
                    "tags": [
                        "patch"
                    ]
                }
            ],
            "metrics": [
                {
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "format": "CVSS",
                    "cvssV3_1": {
                        "version": "3.1",
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "privilegesRequired": "NONE",
                        "userInteraction": "REQUIRED",
                        "scope": "UNCHANGED",
                        "confidentialityImpact": "LOW",
                        "integrityImpact": "NONE",
                        "availabilityImpact": "NONE",
                        "baseSeverity": "MEDIUM",
                        "baseScore": 4.3,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
                    }
                }
            ],
            "workarounds": [
                {
                    "lang": "en",
                    "value": "For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relying on what enableCORS installs, naming the allowed origins.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>For deployments that cannot upgrade immediately, configure the CrossOriginFilter parameters explicitly rather than relying on what enableCORS installs, naming the allowed origins.</p>"
                        }
                    ]
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "value": "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. enableCORS no longer grants credentials to an origin the operator did not name. A deployment that relied on any origin being accepted must now list its origins explicitly.</p>"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Claude Security",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "Andrea Cosentino",
                    "type": "remediation developer"
                }
            ],
            "x_generator": {
                "engine": "Vulnogram 1.0.3"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-10-19T14:33:15.618494Z",
                                "id": "CVE-2026-85313",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-10-19T14:33:28.013Z"
                }
            }
        ]
    }
}