You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/10/19 08:33:36 UTC
[PR] chore: docs - revisit the security model after the 38 advisories of 2026-10-15 [camel]
oscerd opened a new pull request, #28088:
URL: https://github.com/apache/camel/pull/28088
## What
Revisits the security model (`security-model.adoc`, its `security-model.yaml` index and the summary in `AGENTS.md`) in light of the 38 advisories published on 2026-10-15 ([camel-website #1818](https://github.com/apache/camel-website/pull/1818), fixed in 4.18.5, 4.22.1 and 4.23.0).
Some of their lessons were already in the model, but cited by Jira key (CAMEL-24411, CAMEL-24412, CAMEL-24413/24420, CAMEL-24419) or not cited at all, because the CVEs were not public yet. Others were not covered.
## Changes
**Citations.** The Jira keys are replaced by the published CVE IDs. The rules that were added without a citation (unmuted exceptions, CORS, shared state, the HTTP/2 header case, prefix matching, redirects) now name their advisories. All 38 CVEs are cited.
**Adversary model**
- Remote directory listings and HTTP redirects are listed as far-side output that the attacker influences (CVE-2026-79983..79986, CVE-2026-85251). The far side is also untrusted when the service is compromised or shared, or when the protocol leaves its responses unprotected in transit (plain FTP).
- Other local accounts on the host are named as a secondary adversary. They are in scope only for files Camel itself makes readable to them (CVE-2023-34442, CVE-2026-85300).
- A Camel endpoint that manages a component through messages, such as `dynamic-router-control:`, is not a management surface (CVE-2026-83531).
- A configuration that the project's own documentation shows counts as reasonably expected (CVE-2026-78164, CVE-2026-83531, CVE-2026-78163).
**In-scope classes**
- New class: integrity and signature verification that can be skipped (CVE-2026-85243, CVE-2026-85248).
- "SSRF triggered by parsing" becomes "request forgery and credentials sent where the route did not choose". It now covers a message body read as a locator, a destination supplied by the peer, and a redirect (CVE-2026-78163, CVE-2026-80344, CVE-2026-85251).
- Path traversal now covers the remote path that the remote-file consumers retrieve, delete and rename.
- The control-header definition now covers the saga an exchange joins (CVE-2026-85312).
- Mapping sites now include producers that parse a document (CVE-2026-85249).
- Auth: a check whose claim is absent fails closed (CVE-2026-85301), and authentication is never inherited from a pooled thread (CVE-2026-84181; the skip was reachable with `alwaysReauthenticate=false`).
- Expression injection: forwarding messages to an endpoint is not asking for their content to be evaluated (CVE-2026-83531).
- XXE: `FEATURE_SECURE_PROCESSING` alone depends on the implementation (CVE-2026-91858).
- Disclosure: payload content in the default logs (CVE-2026-85260) and secret files readable by other accounts (CVE-2026-85300).
- Insecure defaults: a library object that Camel builds to do its own work (a serializer, a filter, a parser factory) carries Camel's defaults (CVE-2026-78165, CVE-2026-85313, CVE-2026-91858). The connection, TLS and authentication defaults of a wrapped client stay inherited posture.
**Core invariants.** The dispatch invariant now covers the saga an exchange joins (CVE-2026-85312). The placeholder invariant gets its first concrete instance (CVE-2026-78164).
**Severity tiers.** The "indicative severity" column said its tiers reflect how the PMC has historically scored each class. Several rows read "Critical (9.0-9.8)", but no advisory for these artifacts has been rated Critical since 2014: the three Critical ratings are CVE-2013-4330, CVE-2014-0002 and CVE-2014-0003. The column now gives, for each class, the range published since 2015. The note under the table says Critical remains available for code execution or full compromise with no precondition.
**Triage aids**
- New false friend: a `Camel*` header name is not a trust marker (CVE-2026-78164).
- Two new "inverse error" entries under known non-findings: a message that reaches a control endpoint, and a finding that needs a third-party implementation on the class path.
- The incomplete-fix rule now cites CVE-2026-78162 and CVE-2026-85314.
- The per-option opt-in table adds the options introduced by the fixes.
- Deployment hardening adds egress restriction, the encrypted variant of a protocol where one exists, and the umask.
- Component-author guidance gets new questions on content sniffing, code taken from messages, placeholder resolution at runtime, signature verification, payload logging, secret files and third-party defaults.
Two points need PMC judgement:
1. The severity recalibration changes guidance that triage tooling reads.
2. The heritage-defaults known limitation now lists `signatureVerificationOption=optional` (`camel-crypto-pgp`). CVE-2026-85243 kept that default on purpose, and the change records that position.
Docs only. Rendered with Asciidoctor.js and gave no warnings (as `main`). `security-model.yaml` parses. No new `xref:` links.
---
_Claude Code on behalf of @oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore: docs - revisit the security model after the 38 advisories of 2026-10-15 [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on code in PR #28088:
URL: https://github.com/apache/camel/pull/28088#discussion_r4312052134
##########
docs/user-manual/modules/ROOT/pages/security-model.adoc:
##########
@@ -318,47 +346,65 @@ which protective property it breaks.
| Untrusted data is never turned into executed code or OS commands
| A crafted message, header or attachment causes a deserialisation gadget chain, a bean / method / command dispatch, an expression/template evaluation the route author never requested, or is spliced into the argument vector of an external process the component launches
-| Critical (CVSS 9.0-10.0)
+| Medium to High
| Untrusted data cannot redirect the route to a different endpoint, bean, method or command
-| A control header injected from the wire changes where the exchange is dispatched, which operation runs, or which transport and credentials are used - whether it is spelled inside the internal namespace (`CamelBeanMethodName`, `CamelExecCommandExecutable`, `CamelHttpUri`, `CamelJmsDestinationName`, ...) or outside it (`websocket.connectionKey`, `+gridfs.*+`, `irc.sendTo`, `operationName`, `+mail.smtp.*+`, ...)
-| Critical (CVSS 9.0-9.8)
+| A control header injected from the wire changes where the exchange is dispatched, which operation runs, which saga it joins, or which transport and credentials are used - whether it is spelled inside the internal namespace (`CamelBeanMethodName`, `CamelExecCommandExecutable`, `CamelHttpUri`, `CamelJmsDestinationName`, ...) or outside it (`websocket.connectionKey`, `+gridfs.*+`, `irc.sendTo`, `operationName`, `+mail.smtp.*+`, `Long-Running-Action`, ...)
+| Medium to High
| Untrusted data is never deserialised into arbitrary Java types
| A consumer, type converter or persisted-state repository instantiates attacker-chosen classes through `ObjectInputStream` / XStream / Hessian / polymorphic Jackson without an effective filter
-| Critical when gadget-reachable (9.0-9.8); High otherwise (7.0-8.6)
+| Medium to High
| Untrusted parsing does not resolve external or remote resources
| An XML / XSLT / XSD / XPath parse of attacker input reads a local file, performs SSRF, or fetches a remote DTD or stylesheet by default
-| High (CVSS 7.5-8.6); Critical if it yields RCE or credential theft
+| Medium to High
+
+| Untrusted input does not choose the host Camel connects to or the file it reads, and the endpoint's credentials go only to the hosts the route configured
+| A message body is read as a URL to fetch or a path to read, an address the peer supplies becomes the destination of an outbound request, or a redirect carries the endpoint's credentials to a host the remote server chose
+| Medium to High
| Untrusted file names or URI components cannot escape the configured root
-| A file / mail / FTP / object-store consumer or producer reads or writes a path outside the configured directory via `../` or an absolute path, whether that name arrived in a header or was reported back by the remote store
-| High (CVSS 7.5-8.8)
+| A file / mail / FTP / object-store consumer or producer reads or writes a path outside the configured directory via `../` or an absolute path, whether that name arrived in a header or was reported back by the remote store - including a remote-file consumer that retrieves, deletes or renames a file on the server outside the polled directory because of a name in the server's listing
+| Medium to High
| Components that advertise authentication or authorization actually enforce it
-| A request is served without a valid token, with an unvalidated issuer / audience / signature, on a sub-path the auth handler was assumed to cover, because a check was silently skipped when its option was left unconfigured, or because the authorization decision was computed from a differently-normalized value than the dispatch decision
-| Critical (CVSS 9.0-9.8)
+| A request is served without a valid token, with an unvalidated issuer / audience / signature, or on a sub-path the auth handler was assumed to cover. Typical causes: a check was silently skipped because its option was left unconfigured or the claim it checks was absent; a failed check did not stop the exchange; an authentication that an earlier exchange left on the thread was reused; or the authorization decision was computed from a differently-normalized value than the dispatch decision
+| Medium to High
+
+| Components that verify an integrity code, or a signature the receiver requires, fail closed
+| A message is accepted as unmodified, or as signed when a signature is required, although the check was skipped because the sender chose a format without it, or was computed over another exchange's data
+| Medium
+
+| One exchange's data, keys and authority do not reach another
+| A body, a signing key, a token or a thread-bound authentication left by one exchange is observed or used while another sender's, tenant's or partner's exchange is processed
+| Medium
| Secrets and internal Exchange state are not disclosed
-| Credentials, message bodies or configuration values reach a log, an event, a world-readable file, or an HTTP response visible to a lower-privileged party
-| Medium to High (CVSS 5.3-8.2), depending on what leaks
+| Credentials, message bodies or configuration values reach a log, an event, a file that other local accounts can read, or a response visible to a lower-privileged party
+| Low to Medium
| Untrusted input is not spliced into a back-end query language Camel builds
| Camel constructs a Cypher / XSLT-extension / similar query and the attacker alters its structure rather than only its data
-| High to Critical (CVSS 8.1-9.8)
+| Medium
| All of the above hold with zero security configuration
| Any of the above is reachable simply by adding the component to a route and sending a message, with no risky option explicitly set
| Severity of the underlying class; always in scope
|===
-The tiers above are *indicative*, reflecting how the Camel PMC has historically
-scored these classes. The PMC assigns the definitive CVSS vector per report
-based on attack vector, the configuration required to reach the code path, and
-the concrete impact demonstrated. A finding that needs an unusual non-default
-configuration, or whose impact is limited, may score lower than the tier
-suggests; one that chains into full host compromise may score higher.
+The tiers above are *indicative*: for each class they give the range of
+severities the Camel PMC has published at link:/security/[] since 2015 for the
+artifacts this page covers. The three Critical ratings in that record date
+from 2013 and 2014 (CVE-2013-4330, CVE-2014-0002, CVE-2014-0003), and
+CVE-2026-56140 was published as Low, as hardening alongside a sibling finding.
Review Comment:
Applied as suggested in fd3d9918b946: the note under the severity table now names CVE-2026-80351 and CVE-2026-80352 and says they are triaged against Camel K's own scope, so the count a reader sees on the index matches the page. Thanks!
_Claude Code on behalf of oscerd_
##########
docs/user-manual/modules/ROOT/attachments/security-model.yaml:
##########
@@ -124,39 +138,69 @@ config_variants:
- option: hostnameVerificationEnabled
insecure_value: false
default: component-dependent
+ - option: requireIntegrityProtection # camel-crypto-pgp
+ insecure_value: false
+ default: true # CVE-2026-85243
+ - option: allowPredicateFromMessage # dynamic-router-control
+ insecure_value: true
+ default: false # CVE-2026-83531; security = insecure:dev
+ - option: allowUrlSource # camel-docling
+ insecure_value: true
+ default: false # CVE-2026-78163; security = insecure:dev
+ - option: allowFilePathSource # camel-docling
+ insecure_value: true
+ default: false # CVE-2026-78163; security = insecure:dev; inputBaseDirectory (unset by default) confines paths when set
+ - option: allowExternalEntities # camel-smooks
+ insecure_value: true
+ default: false # CVE-2026-88901; security = insecure:dev on the smooks: endpoint
+ - option: logPhi # camel-mllp
+ insecure_value: true
+ default: false # CVE-2026-85260
properties_provided:
- # id, violation symptom, indicative severity tier
+ # id, violation symptom, indicative severity tier (the range published at the advisory index since 2015)
- id: no_untrusted_code_execution
symptom: "deserialization gadget / bean-method-command dispatch / expression eval not requested by route / splice into external-process argv"
- severity: critical
+ severity: medium_to_high
- id: no_untrusted_endpoint_redirect
- symptom: "wire-injected control header changes dispatch target, operation, or transport+credentials - inside the namespace (CamelBeanMethodName, CamelHttpUri, ...) or outside it (websocket.connectionKey, gridfs.*, irc.sendTo, operationName, mail.smtp.*)"
- severity: critical
+ symptom: "wire-injected control header changes dispatch target, operation, saga, or transport+credentials - inside the namespace (CamelBeanMethodName, CamelHttpUri, ...) or outside it (websocket.connectionKey, gridfs.*, irc.sendTo, operationName, mail.smtp.*, Long-Running-Action)"
+ severity: medium_to_high
- id: no_arbitrary_deserialization
symptom: "attacker-chosen types instantiated via ObjectInputStream/XStream/Hessian/polymorphic-Jackson without filter"
- severity: critical_when_gadget_reachable
+ severity: medium_to_high
- id: no_external_resource_resolution_on_parse
symptom: "XML/XSLT/XSD/XPath parse of attacker input reads file / SSRF / fetches remote DTD/stylesheet"
- severity: high
+ severity: medium_to_high
+ - id: no_untrusted_destination_or_credential_forwarding
+ symptom: "message body read as URL/path; peer-supplied address used as outbound destination; redirect carries the endpoint's credentials to a host the server chose"
+ severity: medium_to_high
- id: no_path_escape
- symptom: "file/mail/ftp/object-store path escapes configured root via ../ or absolute name, whether supplied in a header or reported back by the remote store"
- severity: high
+ symptom: "file/mail/ftp/object-store path escapes configured root via ../ or absolute name, whether supplied in a header or reported back by the remote store - incl. remote retrieve/delete/rename outside the polled directory from a listing name"
+ severity: medium_to_high
- id: auth_components_enforce
- symptom: "request served without valid token / unvalidated issuer-audience-signature / uncovered subpath / check silently skipped because its option was unset / authorization computed from a differently-normalized value than dispatch"
- severity: critical
- - id: no_secret_or_state_disclosure
- symptom: "secrets/bodies/config reach a log (INFO/WARN/ERROR), event, world-readable file, or HTTP response"
+ symptom: "request served without valid token / unvalidated issuer-audience-signature / uncovered subpath / check skipped because its option was unset or its claim absent / failed check did not stop the exchange / authentication an earlier exchange left on the thread reused / authorization computed from a differently-normalized value than dispatch"
severity: medium_to_high
+ - id: integrity_and_required_signature_verification_fail_closed
+ symptom: "message accepted as unmodified, or as signed when a signature is required, though the check was skipped (sender-chosen format) or ran over another exchange's data"
+ severity: medium
+ - id: no_cross_exchange_data_or_authority
+ symptom: "body, signing key, token or thread-bound authentication left by one exchange observed or used while another party's exchange is processed"
+ severity: medium
+ - id: no_secret_or_state_disclosure
+ symptom: "secrets/bodies/config reach a log (INFO/WARN/ERROR), event, file other local accounts can read, or a response"
+ severity: low_to_medium
- id: no_backend_query_injection
symptom: "attacker alters the structure of a Cypher/XSLT-extension/etc query Camel builds"
- severity: high_to_critical
+ severity: medium
+
+severity_calibration:
+ note: "tiers are the ranges published at the advisory index since 2015 for the artifacts this model covers; the three Critical ratings date from 2013-2014 (CVE-2013-4330, CVE-2014-0002, CVE-2014-0003); CVE-2026-56140 was published Low as hardening; Critical remains available for code execution or full compromise with no precondition"
Review Comment:
Done in fd3d9918b946: the `severity_calibration` note now says the Critical Camel K advisories on the index (CVE-2026-80351, CVE-2026-80352) are out of this model's scope, matching the prose.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore: docs - revisit the security model after the 38 advisories of 2026-10-15 [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #28088:
URL: https://github.com/apache/camel/pull/28088#issuecomment-6263103680
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore: docs - revisit the security model after the 38 advisories of 2026-10-15 [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus merged PR #28088:
URL: https://github.com/apache/camel/pull/28088
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore: docs - revisit the security model after the 38 advisories of 2026-10-15 [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on code in PR #28088:
URL: https://github.com/apache/camel/pull/28088#discussion_r4311989724
##########
docs/user-manual/modules/ROOT/pages/security-model.adoc:
##########
@@ -318,47 +346,65 @@ which protective property it breaks.
| Untrusted data is never turned into executed code or OS commands
| A crafted message, header or attachment causes a deserialisation gadget chain, a bean / method / command dispatch, an expression/template evaluation the route author never requested, or is spliced into the argument vector of an external process the component launches
-| Critical (CVSS 9.0-10.0)
+| Medium to High
| Untrusted data cannot redirect the route to a different endpoint, bean, method or command
-| A control header injected from the wire changes where the exchange is dispatched, which operation runs, or which transport and credentials are used - whether it is spelled inside the internal namespace (`CamelBeanMethodName`, `CamelExecCommandExecutable`, `CamelHttpUri`, `CamelJmsDestinationName`, ...) or outside it (`websocket.connectionKey`, `+gridfs.*+`, `irc.sendTo`, `operationName`, `+mail.smtp.*+`, ...)
-| Critical (CVSS 9.0-9.8)
+| A control header injected from the wire changes where the exchange is dispatched, which operation runs, which saga it joins, or which transport and credentials are used - whether it is spelled inside the internal namespace (`CamelBeanMethodName`, `CamelExecCommandExecutable`, `CamelHttpUri`, `CamelJmsDestinationName`, ...) or outside it (`websocket.connectionKey`, `+gridfs.*+`, `irc.sendTo`, `operationName`, `+mail.smtp.*+`, `Long-Running-Action`, ...)
+| Medium to High
| Untrusted data is never deserialised into arbitrary Java types
| A consumer, type converter or persisted-state repository instantiates attacker-chosen classes through `ObjectInputStream` / XStream / Hessian / polymorphic Jackson without an effective filter
-| Critical when gadget-reachable (9.0-9.8); High otherwise (7.0-8.6)
+| Medium to High
| Untrusted parsing does not resolve external or remote resources
| An XML / XSLT / XSD / XPath parse of attacker input reads a local file, performs SSRF, or fetches a remote DTD or stylesheet by default
-| High (CVSS 7.5-8.6); Critical if it yields RCE or credential theft
+| Medium to High
+
+| Untrusted input does not choose the host Camel connects to or the file it reads, and the endpoint's credentials go only to the hosts the route configured
+| A message body is read as a URL to fetch or a path to read, an address the peer supplies becomes the destination of an outbound request, or a redirect carries the endpoint's credentials to a host the remote server chose
+| Medium to High
| Untrusted file names or URI components cannot escape the configured root
-| A file / mail / FTP / object-store consumer or producer reads or writes a path outside the configured directory via `../` or an absolute path, whether that name arrived in a header or was reported back by the remote store
-| High (CVSS 7.5-8.8)
+| A file / mail / FTP / object-store consumer or producer reads or writes a path outside the configured directory via `../` or an absolute path, whether that name arrived in a header or was reported back by the remote store - including a remote-file consumer that retrieves, deletes or renames a file on the server outside the polled directory because of a name in the server's listing
+| Medium to High
| Components that advertise authentication or authorization actually enforce it
-| A request is served without a valid token, with an unvalidated issuer / audience / signature, on a sub-path the auth handler was assumed to cover, because a check was silently skipped when its option was left unconfigured, or because the authorization decision was computed from a differently-normalized value than the dispatch decision
-| Critical (CVSS 9.0-9.8)
+| A request is served without a valid token, with an unvalidated issuer / audience / signature, or on a sub-path the auth handler was assumed to cover. Typical causes: a check was silently skipped because its option was left unconfigured or the claim it checks was absent; a failed check did not stop the exchange; an authentication that an earlier exchange left on the thread was reused; or the authorization decision was computed from a differently-normalized value than the dispatch decision
+| Medium to High
+
+| Components that verify an integrity code, or a signature the receiver requires, fail closed
+| A message is accepted as unmodified, or as signed when a signature is required, although the check was skipped because the sender chose a format without it, or was computed over another exchange's data
+| Medium
+
+| One exchange's data, keys and authority do not reach another
+| A body, a signing key, a token or a thread-bound authentication left by one exchange is observed or used while another sender's, tenant's or partner's exchange is processed
+| Medium
| Secrets and internal Exchange state are not disclosed
-| Credentials, message bodies or configuration values reach a log, an event, a world-readable file, or an HTTP response visible to a lower-privileged party
-| Medium to High (CVSS 5.3-8.2), depending on what leaks
+| Credentials, message bodies or configuration values reach a log, an event, a file that other local accounts can read, or a response visible to a lower-privileged party
+| Low to Medium
| Untrusted input is not spliced into a back-end query language Camel builds
| Camel constructs a Cypher / XSLT-extension / similar query and the attacker alters its structure rather than only its data
-| High to Critical (CVSS 8.1-9.8)
+| Medium
| All of the above hold with zero security configuration
| Any of the above is reachable simply by adding the component to a route and sending a message, with no risky option explicitly set
| Severity of the underlying class; always in scope
|===
-The tiers above are *indicative*, reflecting how the Camel PMC has historically
-scored these classes. The PMC assigns the definitive CVSS vector per report
-based on attack vector, the configuration required to reach the code path, and
-the concrete impact demonstrated. A finding that needs an unusual non-default
-configuration, or whose impact is limited, may score lower than the tier
-suggests; one that chains into full host compromise may score higher.
+The tiers above are *indicative*: for each class they give the range of
+severities the Camel PMC has published at link:/security/[] since 2015 for the
+artifacts this page covers. The three Critical ratings in that record date
+from 2013 and 2014 (CVE-2013-4330, CVE-2014-0002, CVE-2014-0003), and
+CVE-2026-56140 was published as Low, as hardening alongside a sibling finding.
Review Comment:
The index this links to also lists two Critical advisories from 2026, CVE-2026-80351 and CVE-2026-80352. They are Camel K advisories, so they are outside "the artifacts this page covers" and the sentence is correct, but a reader who follows the link will count five Critical ratings, not three. Naming them would avoid the confusion:
```suggestion
artifacts this page covers. The three Critical ratings in that record date
from 2013 and 2014 (CVE-2013-4330, CVE-2014-0002, CVE-2014-0003); the index
also lists Critical Camel K advisories (CVE-2026-80351, CVE-2026-80352), which
are triaged against Camel K's own scope. CVE-2026-56140 was published as Low,
as hardening alongside a sibling finding.
```
##########
docs/user-manual/modules/ROOT/attachments/security-model.yaml:
##########
@@ -124,39 +138,69 @@ config_variants:
- option: hostnameVerificationEnabled
insecure_value: false
default: component-dependent
+ - option: requireIntegrityProtection # camel-crypto-pgp
+ insecure_value: false
+ default: true # CVE-2026-85243
+ - option: allowPredicateFromMessage # dynamic-router-control
+ insecure_value: true
+ default: false # CVE-2026-83531; security = insecure:dev
+ - option: allowUrlSource # camel-docling
+ insecure_value: true
+ default: false # CVE-2026-78163; security = insecure:dev
+ - option: allowFilePathSource # camel-docling
+ insecure_value: true
+ default: false # CVE-2026-78163; security = insecure:dev; inputBaseDirectory (unset by default) confines paths when set
+ - option: allowExternalEntities # camel-smooks
+ insecure_value: true
+ default: false # CVE-2026-88901; security = insecure:dev on the smooks: endpoint
+ - option: logPhi # camel-mllp
+ insecure_value: true
+ default: false # CVE-2026-85260
properties_provided:
- # id, violation symptom, indicative severity tier
+ # id, violation symptom, indicative severity tier (the range published at the advisory index since 2015)
- id: no_untrusted_code_execution
symptom: "deserialization gadget / bean-method-command dispatch / expression eval not requested by route / splice into external-process argv"
- severity: critical
+ severity: medium_to_high
- id: no_untrusted_endpoint_redirect
- symptom: "wire-injected control header changes dispatch target, operation, or transport+credentials - inside the namespace (CamelBeanMethodName, CamelHttpUri, ...) or outside it (websocket.connectionKey, gridfs.*, irc.sendTo, operationName, mail.smtp.*)"
- severity: critical
+ symptom: "wire-injected control header changes dispatch target, operation, saga, or transport+credentials - inside the namespace (CamelBeanMethodName, CamelHttpUri, ...) or outside it (websocket.connectionKey, gridfs.*, irc.sendTo, operationName, mail.smtp.*, Long-Running-Action)"
+ severity: medium_to_high
- id: no_arbitrary_deserialization
symptom: "attacker-chosen types instantiated via ObjectInputStream/XStream/Hessian/polymorphic-Jackson without filter"
- severity: critical_when_gadget_reachable
+ severity: medium_to_high
- id: no_external_resource_resolution_on_parse
symptom: "XML/XSLT/XSD/XPath parse of attacker input reads file / SSRF / fetches remote DTD/stylesheet"
- severity: high
+ severity: medium_to_high
+ - id: no_untrusted_destination_or_credential_forwarding
+ symptom: "message body read as URL/path; peer-supplied address used as outbound destination; redirect carries the endpoint's credentials to a host the server chose"
+ severity: medium_to_high
- id: no_path_escape
- symptom: "file/mail/ftp/object-store path escapes configured root via ../ or absolute name, whether supplied in a header or reported back by the remote store"
- severity: high
+ symptom: "file/mail/ftp/object-store path escapes configured root via ../ or absolute name, whether supplied in a header or reported back by the remote store - incl. remote retrieve/delete/rename outside the polled directory from a listing name"
+ severity: medium_to_high
- id: auth_components_enforce
- symptom: "request served without valid token / unvalidated issuer-audience-signature / uncovered subpath / check silently skipped because its option was unset / authorization computed from a differently-normalized value than dispatch"
- severity: critical
- - id: no_secret_or_state_disclosure
- symptom: "secrets/bodies/config reach a log (INFO/WARN/ERROR), event, world-readable file, or HTTP response"
+ symptom: "request served without valid token / unvalidated issuer-audience-signature / uncovered subpath / check skipped because its option was unset or its claim absent / failed check did not stop the exchange / authentication an earlier exchange left on the thread reused / authorization computed from a differently-normalized value than dispatch"
severity: medium_to_high
+ - id: integrity_and_required_signature_verification_fail_closed
+ symptom: "message accepted as unmodified, or as signed when a signature is required, though the check was skipped (sender-chosen format) or ran over another exchange's data"
+ severity: medium
+ - id: no_cross_exchange_data_or_authority
+ symptom: "body, signing key, token or thread-bound authentication left by one exchange observed or used while another party's exchange is processed"
+ severity: medium
+ - id: no_secret_or_state_disclosure
+ symptom: "secrets/bodies/config reach a log (INFO/WARN/ERROR), event, file other local accounts can read, or a response"
+ severity: low_to_medium
- id: no_backend_query_injection
symptom: "attacker alters the structure of a Cypher/XSLT-extension/etc query Camel builds"
- severity: high_to_critical
+ severity: medium
+
+severity_calibration:
+ note: "tiers are the ranges published at the advisory index since 2015 for the artifacts this model covers; the three Critical ratings date from 2013-2014 (CVE-2013-4330, CVE-2014-0002, CVE-2014-0003); CVE-2026-56140 was published Low as hardening; Critical remains available for code execution or full compromise with no precondition"
Review Comment:
Same point for the machine-readable index: the two Critical Camel K advisories of 2026 (CVE-2026-80351, CVE-2026-80352) appear on the advisory index too, so it may help to say they are out of this model's scope.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore: docs - revisit the security model after the 38 advisories of 2026-10-15 [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #28088:
URL: https://github.com/apache/camel/pull/28088#issuecomment-6267268141
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `docs`
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 0 of 706 tested, 0 compile-only — current: 0 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **0 affected modules** (current approach: 0).
**Skip-tests mode would test 0 modules** (1 direct + 0 downstream), **skip tests for 0** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (0)</summary>
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/39229871906)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org