CVE-2026-79986 Apache Software Foundation CVE debrief

Who should care

Defenders and administrators of Apache Camel instances, particularly those using the Azure Files component, should assess exposure and apply mitigations. They should verify their Apache Camel versions and configurations, review their deployments, and apply patches or upgrades as needed. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-79986 is a high-severity Path Traversal vulnerability in Apache Camel's Azure Files component, allowing attackers to access files outside the configured directory. Defenders should verify exposure, apply patches or upgrades, and restrict directory access to mitigate the issue.

• Potential unauthorized file access
• Possible data breaches or loss
• Required verification of affected versions and configurations
• Need for prompt patching or upgrades

Technical summary

The vulnerability is caused by improper limitation of a pathname to a restricted directory in Apache Camel's Azure Files component. This allows an attacker to read, delete, or rename files outside the configured polling directory using the endpoint's credentials. The issue arises from the concatenation of the configured directory with the file name reported in the server's directory listing, which applied no lexical normalization and no check that the result stayed inside the directory being polled. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory, governed producer writes but did not constrain this remote operand.

Defensive priority

High

Recommended defensive actions

• Upgrade to Apache Camel 4.23.0
• Apply patches for affected versions (4.18.5 or 4.22.1)
• Review and update configurations to restrict directory access
• Verify affected versions and configurations
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and references to patches and fixes. Defenders should verify exposure by checking their Apache Camel versions and configurations. The vulnerability affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Users should review their deployments and apply mitigations accordingly.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.