Apache Camel fixes eight flaws, including an XXE vulnerability

Apache Camel has released fixes for eight vulnerabilities across multiple components, with the most serious being a high‑severity XXE flaw in camel-saxon. CVE-2026-90885 affected XQuery processing and could allow an external entity declared in a message body to be resolved, potentially exposing local files. The fixes are included in Camel 4.23.0, and also backported to 4.22.2 and 4.18.5 on their respective release lines.

The advisory notes that XXE and other flaws reach back to earlier Camel versions, with precise affected ranges listed per component on the official security page.

Other notable issues include an expression‑injection flaw in camel-aws2-s3 (CVE-2026-95664), where object keys named in a consumed bucket could cause Simple expressions to be evaluated within the Camel process, potentially exposing environment variables and system properties.

Token handling problems are reported as CVE-2026-94386 in camel-oauth, where a shared token cache could allow one profile to obtain another, and CVE-2026-95663 in camel-keycloak, where cached introspection results let expired tokens remain valid for the cache lifetime (default 60 seconds).

Additional medium‑severity flaws include CVE-2026-71569 in camel-a2a (blind SSRF via IPv6 ULA via a hostname), CVE-2026-95628 and CVE-2026-95629 in camel-docling (path flaws, including an incomplete fix for CVE-2026-40047), and CVE-2026-101259 in camel-coap (internal error messages leaked to CoAP clients). Researchers credited include Leon Zlobecki, Zhixi “Jace” Sun, and Andrea Cosentino.

Exploitation status: the advisories do not indicate exploitation in the wild, no public PoCs are confirmed, and none of the CVEs appears in CISA KEV. Affected versions vary by component; for example, XXE and CoAP flaws date back to Camel 4.0.0, while the S3 issue starts at 4.8.0. Patches include upgrading to Camel 4.23.0 (or 4.22.2/4.18.5 on those lines), moving off end‑of‑life lines, and component‑specific mitigations such as removing the CamelAwsS3Key header or disabling OAuth token caching where appropriate.