Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Apache Camel camel-pqc versions 4.18.0 to before 4.18.3 and 4.19.0 to before 4.21.0 are vulnerable to unsafe deserialization in the HashiCorp Vault and AWS Secrets Manager key-lifecycle managers. An attacker who can write to the configured Vault path or AWS secret could store a crafted serialized object that may lead to code execution in the application. Upgrade to camel-pqc 4.21.0, or 4.18.3 on the 4.18.x LTS stream; until then, restrict write access to the key backend to the application's own identity.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.8 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.0084, the 58th percentile, on 8 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:19 UTC First seen by agentprime
- 31 Oct 2026, 14:19 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-857v-xvh8-7hjc
- OSV: GHSA-857v-xvh8-7hjc
- nvd.nist.gov/vuln/detail/CVE-2026-46590
- github.com/apache/camel/pull/23912
- github.com/apache/camel/pull/23914
- github.com/apache/camel/commit/12a9ac3c94d6fda12d16b2c0039db41c6204727e
- github.com/apache/camel/commit/feea08e7847f35dc0e177652b0b02bd45f6c1b4f
- camel.apache.org/security/CVE-2026-46590.html
- github.com/advisories/GHSA-v3vg-332r-mw99
- github.com/apache/camel
- github.com/apache/camel/releases/tag/camel-4.18.3
- github.com/apache/camel/releases/tag/camel-4.21.0
- issues.apache.org/jira/browse/CAMEL-23726