Key points
- CVE-2026-88900 affects Apache Camel versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0.
- The vulnerability allows unauthenticated remote code execution via unsafe Java deserialization.
- Patches are available for the 4.18.x, 4.22.x, and 4.23.x release streams.
Apache Camel versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0 contain a high-severity deserialization flaw. The issue resides in the Camel-JGroups component and allows attackers to execute arbitrary code. Patches are available for supported release streams. End-of-life versions will not receive fixes.
In plain English
The Camel-JGroups consumer processes incoming cluster messages using Java deserialization. It fails to apply an input filter to these messages. This allows any serializable class on the application classpath to be instantiated. If a usable gadget chain exists, code runs during the deserialization process. The flaw permits remote code execution without authentication.
The background
Andrea Cosentino posted the advisory to the oss-security mailing list on October 19. The NVD record assigns CVE-2026-88900 a CVSS score of 8.8. The weakness is classified as CWE-502, Deserialization of Untrusted Data. The default configuration uses UDP multicast without encryption or authentication. This allows any host on the adjacent network to send malicious serialized objects.
What changes now
Users on the 4.22.x stream should upgrade to version 4.22.1. Those on the 4.18.x stream must move to version 4.18.5. Version 4.23.0 also resolves the issue. Earlier release lines, including 4.14.x through 4.21.x, have reached end of life. These older versions will not receive a patch for this vulnerability.
Who needs to act first
Teams usually prioritize systems exposed to internal networks or adjacent subnets first. Check whether your deployments use the default JGroups configuration. Verify if the application classpath contains libraries with known deserialization gadget chains. Implement network segmentation to restrict access to multicast groups. Test patches in isolated environments before rolling them out to production. Back up configurations prior to updating. Monitor logs for unexpected deserialization errors or process spawns.
What to do and how to stay safe: Apache Camel
- Identify all Apache Camel instances running the affected JGroups component versions.
- Restrict network access to the cluster's multicast group and bind ports.
- Apply the vendor-provided patches to supported release streams as soon as possible.
- Move deployments from end-of-life versions to currently supported release lines.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Apache Camel versions are affected by CVE-2026-88900?
Versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0 are affected by this deserialization flaw.
Is there a patch available for end-of-life versions?
No, end-of-life versions such as 4.14.x through 4.21.x will not receive a fix for this issue.
What is the severity rating for this vulnerability?
The NVD rates CVE-2026-88900 as high severity with a CVSS score of 8.8.
