CVE-2026-84176 — camel-platform-http-vertx: CORS credential exposure (reflected origin + credentials)

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where VertxPlatformHttpServerSupport. createCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check — so it went out on every response to a request carrying an Origin header, including responses to origins the handler had just decided not to allow. When camel.server.cors.origins is unset, the handler treats every origin as allowed and echoes the caller's own Origin back as Access-Control-Allow-Origin. Together those produce the credentialed any-origin configuration the fetch specification refuses to express as a literal wildcard — exactly why reflecting the origin is the usual way around that rule. A page on any origin can therefore make credentialed cross-origin requests to the Camel endpoint and read the responses.

Runtime	Directory	Stack
Camel Spring Boot	camel-spring-boot/	Spring Boot 3.5.13 + camel-platform-http-vertx 4.22.0 (affected; fixed 4.22.1)

Camel Quarkus: not applicable. The vulnerable handler is in Camel's own standalone Vert.x platform-http server (camel-platform-http-vertx). On Camel Quarkus, platform-http is served by the Quarkus HTTP server and CORS is handled by Quarkus (quarkus.http.cors.*), not by createCorsHandler(), so this specific defect is not reachable there. (There is also no camel-platform-http-vertx-starter; the Spring Boot module uses the plain camel-platform-http-vertx artifact, which runs its own Vert.x server independent of the Spring Boot web server.)

What it demonstrates

The app starts Camel's Vert.x platform-http server on port 8081 with CORS enabled and no configured origins, and a route platform-http:/api. The attacker sends GET /api with Origin: https://evil.example (an origin never allow-listed) and inspects the response:

• Affected: Access-Control-Allow-Origin: https://evil.example (reflected) and Access-Control-Allow-Credentials: true.
• Fixed: Access-Control-Allow-Credentials is no longer granted to this origin.

cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Expected output on the affected build:

Response CORS headers:
    Access-Control-Allow-Origin      = https://evil.example
    Access-Control-Allow-Credentials = true
>>> PROVEN: the endpoint echoes the attacker's Origin ... and sends Access-Control-Allow-Credentials: true ...

Vulnerability Summary

Property	Value
Component	camel-platform-http-vertx
CWE	CWE-942 (Permissive Cross-domain Policy with Untrusted Domains)
Severity	MEDIUM
Attack vector	A cross-origin (credentialed) request carrying an Origin header to a platform-http-vertx endpoint with CORS enabled and no configured origins
Impact	Any origin can make credentialed cross-origin requests and read the responses
Affected Versions	From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1
Fixed Versions	4.18.5, 4.22.1, 4.23.0
JIRA	CAMEL-24436
Credit	Claude Security Scan Tool

Advisory: https://camel.apache.org/security/CVE-2026-84176.html

The fix

Access-Control-Allow-Credentials: true is no longer emitted unconditionally for every origin; credentials are not granted to an origin that is not explicitly allowed, so the reflected-origin-plus-credentials ("credentialed any-origin") combination no longer occurs.

Mitigation if you cannot upgrade

Set an explicit camel.server.cors.origins allow-list, and do not rely on credentialed cross-origin access from arbitrary origins; place the endpoint behind a proxy that enforces a correct CORS policy.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. Do not use this material against systems you do not own or operate.