oscerd/cve-2026-46590Reproducer for CVE-2026-46590: Apache Camel camel-pqc key-lifecycle unsafe deserialization (FileBasedKeyLifecycleManager legacy .key migration via ObjectInputStream), incomplete remediation of CVE-2026-40048 (fixed in 4.18.3/4.21.0)
| Runtime | Directory | Stack |
|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.2.0 + camel-pqc 4.18.2 |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.36.0 + Camel Quarkus 3.36.0 (bundles Camel 4.20.0) |
Both are affected versions (fixed in 4.18.3 / 4.21.0), and both demonstrate the identical defect:
FileBasedKeyLifecycleManager persists post-quantum keys as PKCS#8/X.509 JSON, but still migrates legacy
(Java-serialized) key files back with a raw ObjectInputStream and no ObjectInputFilter — the
incomplete-remediation residue of CVE-2026-40048. getKey(keyId) falls back to migrateLegacyKey(), which
deserializes the attacker-planted <keyId>.key file; the cast to KeyPair happens only after readObject()
returns, so a crafted object executes first (CWE-502).
Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README. In
short, for either:
cd camel-spring-boot # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
| Property | Value |
|---|---|
| Component | camel-pqc |
| Affected Class | org.apache.camel.component.pqc.lifecycle.FileBasedKeyLifecycleManager#migrateLegacyKey (and migrateLegacyMetadata), plus the HashicorpVault / AwsSecretsManager siblings |
| CWE | CWE-502 (Deserialization of Untrusted Data) |
| Impact | Code execution in the key-management application when a legacy key/metadata value is read |
| Affected Versions | From 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0 (camel-pqc key managers do not exist before 4.16.0, so 4.14.x is not affected) |
| Fixed Versions | 4.18.3, 4.21.0 |
| JIRA | CAMEL-23726 (PR apache/camel#23912, backport #23914) |
| Credit | Yu Bao (PayPal) |
These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.