camel-undertow Rest DSL muteException Stack-Trace Disclosure Reproducer (CVE-2026-56139)

This project demonstrates an information-disclosure issue in Apache Camel's camel-undertow Rest DSL consumer, tracked as CVE-2026-56139. The muteException option controls whether an uncaught processing exception's detail is returned to the HTTP client. On a plain undertow endpoint the option works — but the undertow Rest DSL creates its response binding with muteException hard-coded to false and never copies the configured value, so muteException is silently ignored in REST mode and the full Java stack trace is returned anyway:

// UndertowComponent (affected 4.18.2) — the Rest DSL binding is created without the endpoint's muteException
if (!map.containsKey("undertowHttpBinding")) {
    endpoint.setUndertowHttpBinding(new RestUndertowHttpBinding(endpoint.isUseStreaming()));  // muteException stays false
}

Because the endpoint's undertowHttpBinding is now non-null, UndertowEndpoint.getUndertowHttpBinding() returns that Rest binding as-is and never runs the branch that copies the endpoint's muteException onto it. So a route that explicitly sets muteException=true still leaks stack traces when served through the Rest DSL — disclosing internal backend hostnames, database URLs, credential/vault hints, library versions, and source locations.

This PoC demonstrates the impact as information exposure through an error message (CWE-209). It is the Rest-DSL-specific counterpart of CVE-2026-49365 (which corrected the muteException default for plain camel-netty-http and camel-undertow endpoints); both were fixed together under CAMEL-23651.

Advisory: https://camel.apache.org/security/CVE-2026-56139.html

Vulnerability Summary

The fix makes the Rest DSL path copy endpoint.getMuteException() into the RestUndertowHttpBinding, so the Rest DSL honours the setting (and the corrected default of true).

The victim routes

// Both configured with muteException=true (camel.component.undertow.mute-exception=true):
restConfiguration().component("undertow").host("0.0.0.0").port(8888);
rest("/api").get("/orders").to("direct:boom");            // Rest DSL — IGNORES muteException, leaks
from("direct:boom").process(new FailingProcessor());

from("undertow:http://0.0.0.0:8889/plain/orders")         // plain endpoint — HONOURS muteException, empty body
    .process(new FailingProcessor());

Repository layout

CVE-2026-56139/
├── pom.xml                 # camel-undertow 4.18.2
├── Dockerfile
├── docker-compose.yml      # single self-contained service
├── README.md
└── src/main/
    ├── java/com/example/
    │   ├── Application.java
    │   ├── FailingProcessor.java   # throws an exception carrying sensitive internal detail
    │   ├── RestRoutes.java         # undertow Rest DSL (:8888) + plain undertow endpoint (:8889)
    │   └── ExploitController.java  # attacker: GETs both, shows Rest DSL leaks while plain is muted
    └── resources/
        └── application.properties  # camel.component.undertow.mute-exception=true

Prerequisites

• Docker and Docker Compose
• Java 17+ and Maven 3.8+

Reproduction Steps

mvn clean package -DskipTests
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Expected output (abridged)

1) undertow Rest DSL :8888  (muteException=true, but the Rest binding hard-codes false)
     HTTP 500
     response body (NNNN bytes) — LEAKS internal detail:
       | java.lang.IllegalStateException: Inventory lookup failed: cannot connect to
       |   jdbc:postgresql://prod-db.internal:5432/inventory (user=svc_inventory, ...)
       | 	at com.example.FailingProcessor.process(FailingProcessor.java:...)
       | 	...[truncated]

2) plain undertow endpoint :8889  (same muteException=true — honoured)
     HTTP 500
     response body: <empty>

>>> Information disclosure: true

Recommended Fix

Upgrade to 4.14.8 / 4.18.3 / 4.21.0 (CAMEL-23651). After upgrading, the undertow Rest DSL honours muteException (and defaults it to true), so the stack trace is not returned.

Mitigation

Until upgrading, add an onException(...).handled(true) (or a global error handler) that returns a generic message instead of the stack trace, and do not rely on muteException alone for undertow Rest DSL consumers.

Disclaimer

This reproducer is provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use it against systems without explicit permission.