Apache Camel contains an insecure deserialization vulnerability that allows authenticated attackers to achieve remote code execution in the context of the application.

The camel-infinispan component utilizes java.io.ObjectInputStream for deserializing data from a remote cache without implementing an ObjectInputFilter. An attacker with access to the Infinispan cache can inject malicious serialized objects to execute arbitrary code.

Successful exploitation allows an attacker to execute arbitrary code on the underlying server, leading to a full compromise of the application environment. Given the high CVSS score of 8.8, this vulnerability poses a severe risk to data integrity, confidentiality, and operational availability, potentially resulting in unauthorized access to sensitive business data or total system disruption.

Immediate Action: Upgrade the camel-infinispan component to version 4.14.7 (for LTS 4.14.x), 4.18.2 (for LTS 4.18.x), or 4.20.0, as these versions correctly implement the necessary deserialization filters.

Proactive Monitoring: Review application logs for unexpected deserialization exceptions or suspicious activity originating from the Infinispan cache connection.

Compensating Controls: Ensure that access to the Infinispan cache is strictly restricted to authorized services and that network-level segmentation prevents unauthorized entities from interacting with the cache.

Public Exploit Available: Yes, a public proof-of-concept exists via the GitHub repository: https://github.com/oscerd/CVE-2026-40858.

Due to the severity of this remote code execution flaw and the availability of a public proof-of-concept, immediate patching is required. Organizations using the affected Apache Camel versions must prioritize updating to the specified fixed versions to eliminate the deserialization risk and prevent potential exploitation.