A critical deserialization vulnerability in Apache Camel PQC allows an attacker with local file system access to achieve remote code execution.

This flaw involves the use of java.io.ObjectInputStream to deserialize key files without adequate filtering or class-loading restrictions. An attacker who can write to the key directory can execute arbitrary code during the deserialization process, requiring low privileges on the local system.

The ability to execute arbitrary code on a system hosting Apache Camel services poses a severe risk to data integrity, confidentiality, and system availability. With a CVSS score of 7.8, this high-severity vulnerability could allow an attacker to gain full control over the application environment, potentially leading to unauthorized access to sensitive cryptographic keys and internal application data.

Immediate Action: Upgrade to Apache Camel PQC version 4.20.0 or 4.18.2 to ensure the replacement of vulnerable deserialization methods with secure PKCS#8 and X.509 JSON encoding.

Proactive Monitoring: Review filesystem access logs for the configured key directory to identify unauthorized modifications or attempts to write files with the .key extension.

Compensating Controls: Ensure strict filesystem permissions are enforced on directories containing keys to prevent unauthorized users from placing malicious serialized objects in the application path.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub (oscerd/CVE-2026-40048).

Given the availability of a public proof-of-concept and the potential for full code execution, this vulnerability should be prioritized for immediate remediation. Organizations utilizing Apache Camel PQC must audit their deployment environments for the affected versions and apply the provided patches to eliminate the deserialization risk.