CVE-2026-85246 — camel-mina: consumer information disclosure (exception written over the socket)

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the Mina consumer wrote exchange.getException() straight back over the socket to the remote peer when processing of an exchange failed. Over a textline codec that hands the peer the exception's class name and message; over the object codec it hands over the serialised exception, cause chain included. A remote peer able to provoke a failure could read internal detail about the deployment — class and package names, and whatever a message or nested cause carries, which in practice includes paths, host names and connection detail. The consumer had no option to suppress this, unlike the HTTP-family consumers aligned by CAMEL-23651.

Spring Boot only. There is no camel-quarkus-mina extension, so this reproducer ships a single Camel Spring Boot module. (The flaw is in the component's MinaConsumer, which is runtime-independent.)

Runtime	Directory	Stack
Camel Spring Boot	camel-spring-boot/	Spring Boot 3.5.13 + camel-mina 4.22.0 (affected; fixed 4.22.1)

What it demonstrates

A Mina TCP consumer (sync=true, textline=true) processes each incoming line and fails — standing in for any route that hits an internal error. The route throws an IllegalStateException whose message carries simulated internal detail (a fake config path /etc/camel/secret.properties, a fake host, and a marker token). The exploit driver is a plain remote TCP peer: it opens a socket, sends one line, and reads the reply the consumer writes back.

• Affected: the reply is the route's exception rendered by the textline codec — java.lang.IllegalStateException: INTERNAL-DETAIL-MARKER-7F3A2B config=/etc/camel/secret.properties db=internal-db.prod.svc.
• Fixed: the reply is a generic java.lang.Exception: Exchange processing failed — no class, message or stack trace of the route's exception — while still replying, so a synchronous peer is not left to time out.

cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected: exception leaks over the socket; >>> PROVEN
docker compose down
# Patched control
mvn clean package -Dcamel.version=4.22.1
java -jar target/cve-2026-85246-mina-info-disclosure-0.0.1-SNAPSHOT.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: generic reply; >>> Not exploited

Vulnerability Summary

Property	Value
Component	camel-mina (MinaConsumer.messageReceived)
CWE	CWE-209 (Generation of Error Message Containing Sensitive Information)
Severity	MEDIUM
Attack vector	A remote TCP/UDP peer provokes a route failure and reads the exception from the reply written back over the socket
Impact	Information disclosure: exception class/message over the textline codec, or the serialised exception + cause chain over the object codec (internal hostnames, paths, connection detail)
Affected Versions	From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1
Fixed Versions	4.18.5, 4.22.1, 4.23.0
JIRA	CAMEL-24476
Credit	Claude Security Scan Tool

Advisory: https://camel.apache.org/security/CVE-2026-85246.html

The fix

MinaConsumer adds a muteException consumer option (default true). When enabled, a failed exchange no longer writes exchange.getException() back; instead it writes a stand-in Exception("Exchange processing failed") with an empty stack trace — still an Exception (so an object-codec peer still receives one) but carrying no class, message or frames of the route's exception. A reply is still written so a synchronous peer is not left to time out. Set muteException=false to restore the previous behaviour.

Mitigation if you cannot upgrade

Add an onException handler that sets the reply body explicitly, so the framework never writes the exception back to the peer.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The config path, host and marker token in the failing route are inert, made-up local fixtures. Do not use this material against systems you do not own or operate.