Apache Camel patches XXE, deserialization, and credential flaws
Saxon needs 4.18.5, 4.22.2, or 4.23.0; stopping at the XPath and Smooks fix 4.22.1 misses it.
1
Stories per day · 30 days
2 RSS
Relatedapache1apache-camel1apache-pulsar1couchdb1deserialization1end-of-life1missing-authentication1oauth1pulsar-manager1replicator1xxe1
6 stories, newest first · one card per story
Stories tagged #credential-disclosure
Apache Pulsar Manager missing auth leaks admin credentials (CVE-2026-105944)
The Apache Pulsar PMC says the end-of-life manager lacks authentication and authorization and can expose Pulsar admin credentials.
CouchDB before 3.5.3 leaks other users' replication credentials
An authenticated user can read replication credentials stored for other users in the _replicator database.
CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials
DolphinScheduler before 3.4.3 lets non-admins retrieve Kubernetes kubeconfig credentials.
Re: CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
Follow-up on oss-security asks why CVE-2026-82434, Apache Storm ZooKeeper credential disclosure to read-only users and logs, lacks a severity rating.
CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
Apache Storm Nimbus and Client expose ZooKeeper topology credentials to read-only users and logs, fixed in 3.1.0.