Apache Camel JGroups deserializes cluster messages to RCE
Original title: CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution
CVE-2026-88900 scores CVSS 8.8; fixed builds are 4.18.5 and 4.22.1.
Apache Camel’s camel-jgroups component can deserialize untrusted cluster messages, which the advisory says can lead to remote code execution. Affected releases are 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1. Andrea Cosentino posted the notice on October 19 with a CVSS 3.1 score of 8.8. The snippet does not say whether the flaw is being exploited.
Unconfirmed: The snippet does not state whether exploitation has been observed.
- The component coordinate is org.apache.camel:camel-jgroups.
- CVSS vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- The issue is unsafe Java deserialization of cluster messages in the JGroups consumer.
Impact: Remote code execution via untrusted cluster-message deserialization
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel camel-jgroups | 4.0.0 before 4.18.5; 4.19.0 before 4.22.1 | 4.18.5; 4.22.1 |
- 1.Upgrade camel-jgroups to 4.18.5 or 4.22.1.
- CVEs
- CVE-2026-88900
- Vendors
- Apache
- Products
- Apache Camelcamel-jgroups
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88900 | Unsafe Java deserialization RCE in Apache Camel JGroups | 8.8 | <1% | PoC |
From the original article
Posted by Andrea Cosentino on Oct 19 Severity: CVSS 3. 1: 8. 8 (high) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.