CVE-2026-78162 Apache Software Foundation CVE debrief

Who should care

Defenders and administrators of Apache Camel deployments, particularly those using versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1, should assess exposure and prioritize upgrades or mitigations.

Why it matters

CVE-2026-78162 is a critical vulnerability in Apache Camel that allows remote code execution via deserialization of untrusted data. Defenders and administrators of affected deployments should prioritize upgrades or apply mitigations to prevent exploitation.

• Remote code execution via deserialization of untrusted data
• Potential for unauthorized access and data breaches
• Need for immediate upgrade or mitigation to prevent exploitation
• Verification of Hazelcast cluster authentication and TLS configuration

Technical summary

The camel-hazelcast component in Apache Camel applies a default Hazelcast JavaSerializationFilterConfig to instances it creates, but this protection was not applied to two configuration paths, allowing unrestricted Java deserialization. An attacker can exploit this by publishing a malicious Java object to the Hazelcast cluster, leading to remote code execution. This issue allows remote code execution via deserialization of untrusted data in Hazelcast instances created by the camel-hazelcast component. Defenders and administrators of affected deployments should assess exposure and prioritize upgrades or mitigations.

Defensive priority

Upgrade to version 4.23.0 or apply mitigations

Recommended defensive actions

• Upgrade to Apache Camel version 4.23.0
• Apply explicit Hazelcast configuration with JavaSerializationFilterConfig
• Inject a pre-built HazelcastInstance
• Enable Hazelcast cluster authentication and TLS
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. Apache Camel's security advisories and GitHub pull requests offer additional context. Defenders should verify affected deployments, review official advisories, and plan updates or mitigations. Compensating controls and monitoring should be reviewed for exposed systems. Exceptions should be tracked, and remediated assets retested.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.