CVE-2026-84180 — camel-knative: HTTP consumer information disclosure (exception written back to the caller)

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the Knative HTTP consumer, when an exchange failed on the consumer side, wrote the resulting exception back to the remote caller as the HTTP response body — including its class name, message and full stack trace. An external sender could therefore provoke a failure and read internal detail about the deployment: class and package names, file-system or host names carried in exception messages, the shape of the route, and — where an exception message embeds a connection string or configuration — that data directly. camel-knative was the remaining HTTP-family consumer that had not been aligned with the muteException behaviour established for the other HTTP consumers by CAMEL-23651.

Runtime	Directory	Stack
Camel Spring Boot	camel-spring-boot/	Spring Boot 3.5.13 + camel-knative 4.22.0 (affected; fixed 4.22.1), consumer on Camel's Vert.x platform-http server
Camel Quarkus	camel-quarkus/	Quarkus 3.29.0 + camel-quarkus-knative (Camel 4.15.0, affected; fixed control CQ 3.40.0 / Camel 4.22.1), consumer on Quarkus HTTP

Both modules demonstrate the affected and the fixed behaviour.

What it demonstrates

A Knative HTTP source (consumer) route receives a CloudEvent and then fails while processing it — standing in for any route that hits an internal error (a failed datasource lookup, a downstream timeout, a bug). The route throws an IllegalStateException whose message carries simulated internal detail: a fake internal hostname (internal-db.prod.svc.cluster.local), a fake JDBC URL and a marker token INTERNAL-DETAIL-MARKER-7F3A2B. The attacker is simply a remote caller: it POSTs one well-formed CloudEvent to the consumer and reads the response the consumer sends back.

• Affected: the response is HTTP 500 with the full stack trace as the body — the exception class name, the message (internal hostname + marker token), and at com.example... / framework stack frames.
• Fixed: the response is HTTP 500 with an empty body — the consumer now honours muteException (default true), so the error status is returned but no exception detail reaches the caller.

# Camel Spring Boot
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack      # affected: stack trace leaks; prints >>> PROVEN
docker compose down
# Patched control: rebuild with the fixed version, then run on the host
mvn clean package -Dcamel.version=4.22.1
java -jar target/cve-2026-84180-knative-info-disclosure-0.0.1-SNAPSHOT.jar &
curl -s http://localhost:8080/exploit/attack      # fixed: empty body; prints >>> Not exploited

# Camel Quarkus
cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack      # affected (Camel 4.15.0): stack trace leaks; >>> PROVEN
docker compose down
# Patched control: CQ 3.40.0 ships Camel 4.22.1
mvn clean package -Dcamel-quarkus.version=3.40.0 -Dquarkus.platform.version=3.40.0
java -jar target/quarkus-app/quarkus-run.jar &
curl -s http://localhost:8080/exploit/attack      # fixed: empty body; >>> Not exploited

Vulnerability Summary

Property	Value
Component	camel-knative (Knative HTTP consumer, KnativeHttpConsumer.computeResponseBody)
CWE	CWE-209 (Generation of Error Message Containing Sensitive Information)
Severity	MEDIUM
Attack vector	A remote caller provokes a route failure on the consumer side and reads the exception detail from the response body
Impact	Information disclosure: exception class/message/stack trace (internal hostnames, package names, route shape, embedded connection strings) reach an external sender
Affected Versions	From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1
Fixed Versions	4.18.5, 4.22.1, 4.23.0
JIRA	CAMEL-24428
Credit	Claude Security Scan Tool

Advisory: https://camel.apache.org/security/CVE-2026-84180.html

The fix

KnativeHttpConsumer.computeResponseBody now checks a new muteException option (consumer, default true). When muted, a failed exchange yields an empty response body (new byte[0]) rather than the stack trace — the empty body is deliberate so that the error status is preserved (a null body would make the caller send 204 No Content). Set muteException=false to restore the previous output. This aligns camel-knative with the other HTTP-family consumers (CAMEL-23651).

Mitigation if you cannot upgrade

Add an onException handler to the consumer route that sets the response body explicitly (for example to an empty body or a generic message), so the framework never writes the exception back to the caller.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The "internal" hostname, JDBC URL and marker token in the failing route are inert, made-up local fixtures — no real secret is involved. Do not use this material against systems you do not own or operate.