CVE-2026-56139: Apache Camel Undertow Stack Trace Disclosure Vulnerability

Technical summary

The Apache Camel camel-undertow component implements an HTTP server consumer with a muteException configuration option that controls exception disclosure behavior. By default, muteException is set to false, whereas equivalent components (camel-http, camel-jetty, camel-servlet, camel-platform-http) default to true. When false, any unhandled exception during route processing causes the entire Throwable stack trace to be serialized into the HTTP response body as text/plain, bypassing authentication checks. Additionally, the RestUndertowHttpBinding class hardcodes muteException to false, ignoring any configuration directive. This exposes CWE-209 (Information Exposure Through an Error Message) to unauthenticated network clients. The vulnerability spans three release streams: 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x.

Business impact

Organizations running affected Camel versions expose confidential operational data to any party capable of reaching their HTTP endpoints. Attackers can harvest credentials embedded in exception messages, discover internal infrastructure (hostnames, IP addresses, file paths), identify technology stacks and versions, and map application internals—all without authentication. This reconnaissance enables targeted exploitation of discovered services, credential harvesting for lateral movement, and compliance violations if personal or regulated data appears in logs. The risk is amplified in microservices architectures where Undertow-based endpoints are Internet-facing or accessible across trust boundaries.

Affected systems

Apache Camel versions 4.0.0–4.14.7, 4.15.0–4.18.2, and 4.19.0–4.20.x are affected. Deployments using the camel-undertow component for HTTP server endpoints are at risk, particularly those serving Rest DSL routes. The vulnerability is not automatically triggered; it requires an endpoint to be reachable by a client and for a request to cause a processing exception. Systems that have explicitly configured muteException=true on individual Undertow consumers are partially protected, except for Rest DSL routes where the setting is ignored.

Exploitability

Exploitability is straightforward. No special authentication, authorization, or privilege escalation is required—any network client that can reach an affected HTTP endpoint can trigger the vulnerability. The barrier to exploitation is minimal: send any request that causes a route exception (e.g., malformed JSON, missing required parameters, or a crafted input that fails internal validation). The response immediately reveals sensitive information. Public exploit code is unlikely to be necessary; standard HTTP tools suffice. CVSS 5.3 (MEDIUM) reflects the low barrier to exploitation but limited direct impact (information disclosure without integrity or availability compromise).

Remediation

Upgrade to patched versions: 4.21.0 (main release stream), 4.14.8 (LTS stream), or 4.18.3 (4.18 stream). These versions default muteException to true and honor the setting in Rest DSL consumers. For environments unable to upgrade immediately, set muteException=true explicitly via endpoint configuration (e.g., undertow:http://0.0.0.0:8080/api?muteException=true) or globally (camel.component.undertow.mute-exception=true). Note: this workaround does not protect Rest DSL consumers until the patched release is deployed.

Patch guidance

Review your Camel deployment to identify the active version stream. If running 4.14.x, upgrade to 4.14.8 or later. If running 4.15.x through 4.18.x, upgrade to 4.18.3 or later. If running 4.19.0 or later, upgrade to 4.21.0 or later. Before upgrading, verify patch availability through the Apache Camel project repositories and test in a non-production environment to confirm compatibility with your routes and dependencies. Apply upgrades to all instances serving HTTP endpoints via camel-undertow.

Detection guidance

Scan your codebase and runtime configuration for camel-undertow usage, particularly endpoints configured without explicit muteException=true. Search for 'undertow:' route definitions and check for the presence of the muteException parameter. Monitor HTTP access logs for patterns indicative of stack trace reconnaissance: repeated requests with invalid parameters to Undertow endpoints, followed by analysis of responses. Enable HTTP response logging to capture whether stack traces are being returned. Use SAST tools to identify Camel component versions in your build artifacts and dependencies. Runtime application performance monitoring (APM) or Java exception logging can help detect the internal errors being triggered and exposed.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants prompt remediation because it directly enables reconnaissance for further attacks. Information disclosure of credentials, infrastructure topology, and software versions significantly reduces the attack surface an adversary must overcome. The low exploitability barrier and lack of authentication requirements make it an attractive reconnaissance vector. Prioritize based on the sensitivity of data that could appear in stack traces (e.g., API keys, database hostnames), the network accessibility of affected endpoints, and the maturity of your compensating controls. Rest DSL deployments are highest priority due to the ignored mitigation option.

Risk score, explained

CVSS 5.3 reflects the combination of network-accessible, unauthenticated attack vector (AV:N/PR:N/UI:N) with no integrity or availability impact, only confidentiality loss (C:L/I:N/A:N). The score appropriately downgrades what could appear critical (stack trace leakage) because the direct impact is information disclosure rather than system compromise. However, in practice, this information becomes the springboard for higher-severity attacks, making business risk higher than the base score suggests.

Frequently asked questions