CVE-2026-43865: Apache Camel Hazelcast Deserialization RCE Vulnerability

Technical summary

The camel-hazelcast component creates Hazelcast instances using default configuration that lacks Java deserialization filtering. When no user-supplied HazelcastInstance, hazelcastConfigUri, or Config bean is provided, neither Hazelcast's JavaSerializationFilterConfig nor Camel-side ObjectInputFilter is installed. Untrusted objects received over the cluster protocol are deserialized via ObjectInputStream.readObject at Hazelcast's serialization layer before Camel processes them. Any route leveraging hazelcast-topic, hazelcast-queue, hazelcast-seda, hazelcast-map, hazelcast-multimap, hazelcast-replicatedmap, hazelcast-list, or hazelcast-set consumers, plus HazelcastAggregationRepository and HazelcastIdempotentRepository, is exposed when the backing Hazelcast instance derives from Camel's default configuration. Remote code execution occurs without authentication or user interaction required.

Business impact

Organizations running Apache Camel with Hazelcast-based clustering or persistence face potential complete compromise of their Camel infrastructure. An attacker within the network segment containing Hazelcast cluster nodes (or who can reach them via network misconfiguration) can execute arbitrary code across all connected Camel instances simultaneously. This threatens data confidentiality, integrity, and availability, particularly for deployments handling sensitive message routing, data transformation, or aggregation workflows. Incident response overhead and potential regulatory exposure from data breach add business cost.

Affected systems

Apache Camel versions 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x are affected. Systems explicitly at risk include: (1) Camel applications using hazelcast-topic, hazelcast-queue, hazelcast-seda, hazelcast-map, hazelcast-multimap, hazelcast-replicatedmap, hazelcast-list, or hazelcast-set consumers with default Camel-managed Hazelcast instances; (2) deployments using HazelcastAggregationRepository or HazelcastIdempotentRepository backed by Camel-created instances; (3) any environment where Camel routes reference Hazelcast without explicit custom HazelcastInstance or JavaSerializationFilterConfig. Users who supply their own HazelcastInstance or Config bean are not automatically vulnerable, though their custom configuration's security posture still matters.

Exploitability

Exploitation requires network access to the Hazelcast cluster. The attacker does not need valid cluster credentials or authentication tokens in the default Camel setup, as deserialization filtering is absent. However, the attack surface is limited to entities that can reach the cluster network—typically internal systems. Exploitation is deterministic once access is gained: the attacker crafts a malicious serialized Java object using standard gadget chains and publishes it to the cluster, where Camel automatically deserializes it. The CVSS score of 8.1 reflects high impact (code execution, data access, service disruption) and feasible exploitability (network vector, no user interaction), tempered slightly by the assumption that the attacker must have cluster-level network proximity.

Remediation

Upgrade to Apache Camel 4.21.0, 4.18.3 (if on 4.18.x LTS), or 4.14.8 (if on 4.14.x LTS). These versions apply a default Hazelcast JavaSerializationFilterConfig that whitelists safe prefixes (java.*, javax.*, org.apache.camel.*) and blacklists java.net.* to block common exploit vectors. User-supplied Hazelcast configurations or instances remain untouched by this fix. For organizations unable to patch immediately, implement a deserialization filter on Hazelcast instances via JavaSerializationFilterConfig, or set the JVM-wide system property -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!* to deny all classes except approved ones. Additionally, restrict Hazelcast cluster network access by enabling Hazelcast cluster authentication and enforcing TLS for cluster communication to limit who can send malicious objects.

Patch guidance

Verify the Apache Camel version in your deployment: versions 4.0.0–4.14.7, 4.15.0–4.18.2, and 4.19.0–4.20.x require patching. Consult your package manager or Maven Central Repository for the exact upgrade path. For production environments, test the patched version in a staging environment first, particularly if you maintain custom Hazelcast configurations—the fix does not alter user-supplied configs, but verify your setup remains compatible. If you are on an LTS branch, upgrade to the designated LTS patch: 4.14.8 or 4.18.3. Ensure any custom deserialization filters or Hazelcast tweaks survive the upgrade by reviewing your configuration in light of the vendor advisory.

Detection guidance

Monitor for unusual deserialization activity on Camel nodes: enable Java deserialization logging via -Djdk.serialFilter debug mode and scan logs for ObjectInputStream warnings or exceptions. Check Hazelcast cluster join and leave events to detect unauthorized cluster access attempts. Network-level detection: look for unexpected connections to Hazelcast cluster ports from unfamiliar internal hosts, or examine Hazelcast cluster traffic for signs of object serialization (binary payloads) from suspicious sources. Application-level signals include unexpected process spawning on Camel JVMs or memory spikes during deserialization. Given the passive nature of the vulnerability, a combination of configuration audits (confirming Hazelcast instances have deserialization filters) and network segmentation validation is essential.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.1), unauthenticated remote code execution without user interaction, and automatic exposure in default Camel configurations. Any organization running Camel with Hazelcast clustering faces inherent risk unless explicitly mitigated. The attack surface is limited to network-adjacent actors, but cluster networking is often configured with weak boundary assumptions in internal deployments. The simple patch path (version upgrade) and clear mitigation steps make this a high-priority remediation candidate for resource-constrained teams.

Risk score, explained

CVSS 8.1 (HIGH) reflects the combination of network-exploitable remote code execution (AV:N, highest impact), a hardened but achievable attack vector requiring cluster-level access (AC:H), no privilege requirements (PR:N), no user interaction (UI:N), and single system scope (S:U). The impact triad is critical: confidentiality loss (data read), integrity loss (code execution), and availability loss (service disruption or data loss) are all possible. The AC:H adjustment (rather than AC:L) acknowledges that the attacker must be positioned at the network level and able to join or reach the cluster, but this is a modest brake on an otherwise severe flaw. HIGH severity is appropriate given the ease of exploitation once access is achieved and the default exposure.

Frequently asked questions