A critical deserialization vulnerability in Apache Camel, designated as CVE-2026-27172, permits remote code execution if an attacker can write to the Consul KV store associated with the application.

The vulnerability exists in the ConsulRegistry component due to the insecure deserialization of Java objects from the Consul KV store without an ObjectInputFilter. An attacker with low-level privileges capable of modifying the Consul KV store can trigger arbitrary code execution during a registry lookup.

Successful exploitation of this flaw allows an attacker to achieve full remote code execution within the context of the Camel process. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and potential lateral movement within the network.

Immediate Action: Upgrade Apache Camel to version 4.19.0, or apply the patch by upgrading to 4.14.6 if using the 4.14.x LTS stream, or 4.18.1 for the 4.18.x release stream.

Proactive Monitoring: Monitor Consul KV store access logs for unauthorized write operations or unusual key updates that could indicate an injection attempt.

Compensating Controls: Restrict write access to the Consul KV store strictly to authorized administrative accounts and implement network segmentation to isolate the Camel instance from potentially untrusted segments.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository at https://github.com/oscerd/CVE-2026-27172.

This vulnerability presents a significant risk to the integrity and confidentiality of systems utilizing Apache Camel with Consul integration. Security teams must prioritize patching the affected software versions immediately to eliminate the deserialization flaw. Given the existence of a public proof-of-concept, the window for proactive mitigation is limited.