CVE-2026-85247 — camel-knative: improper certificate validation (TLS on turns validation off)

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where enabling SSL on the Knative HTTP client without configuring a truststore fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on without also configuring a truststore therefore obtained an encrypted connection with no peer authentication, which an attacker positioned on the network path can terminate and read. The dangerous state is reached by omission, not by an explicit opt-in — turning TLS on should not be the thing that turns certificate validation off.

Runtime	Directory	Stack
Camel Spring Boot	camel-spring-boot/	Spring Boot 3.5.13 + camel-knative 4.22.0 (affected; fixed 4.22.1)
Camel Quarkus	camel-quarkus/	Quarkus 3.29.0 + camel-quarkus-knative (Camel 4.15.0, affected; fixed control CQ 3.40.0 / Camel 4.22.1)

Both modules demonstrate the affected and the fixed behaviour.

What it demonstrates

The deployment sets camel.knative.client.ssl.enabled=true and configures no truststore. The driver builds the real KnativeSslClientOptions from exactly those settings — the same options the Knative HTTP producer uses — and makes an HTTPS request with them to a bundled server that presents a self-signed certificate (CN=localhost, in no truststore), standing in for a TLS man-in-the-middle.

• Affected: KnativeSslClientOptions.getTrustOptions() is TrustAllOptions, so the client accepts the self-signed certificate and the request succeeds — encrypted but unauthenticated.
• Fixed: the trust options are left unset, so the JVM default trust anchors apply, the self-signed certificate is rejected and the TLS handshake fails with SunCertPathBuilderException: unable to find valid certification path.

# Camel Spring Boot
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected: trusts the self-signed cert; >>> PROVEN
docker compose down
# Patched control
mvn clean package -Dcamel.version=4.22.1
java -jar target/cve-2026-85247-knative-cert-validation-0.0.1-SNAPSHOT.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: handshake fails; >>> Not exploited

# Camel Quarkus
cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected (Camel 4.15.0): trusts the self-signed cert
docker compose down
# Patched control: CQ 3.40.0 ships Camel 4.22.1
mvn clean package -Dcamel-quarkus.version=3.40.0 -Dquarkus.platform.version=3.40.0
java -jar target/quarkus-app/quarkus-run.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: handshake fails

Vulnerability Summary

Property	Value
Component	camel-knative (KnativeSslClientOptions.configureOptions)
CWE	CWE-295 (Improper Certificate Validation)
Severity	MEDIUM
Attack vector	Network man-in-the-middle against a Knative HTTP client that enabled SSL but configured no truststore
Impact	Encrypted connection with no peer authentication: any certificate is trusted, so TLS can be intercepted and read
Affected Versions	From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1
Fixed Versions	4.18.5, 4.22.1, 4.23.0
JIRA	CAMEL-24443
Credit	Claude Security Scan Tool

Advisory: https://camel.apache.org/security/CVE-2026-85247.html

The bundled server-keystore.p12 is a throwaway self-signed key pair (CN=localhost) generated only for this reproducer.

The fix

KnativeSslClientOptions.configureOptions: when SSL is enabled with no keystore, truststore or trust-cert path, the trust options are now left unset, so Vert.x falls back to the JVM default trust anchors — the same fallback SSLContextParameters and the rest of Camel use. TrustAllOptions is now reached only by setting camel.knative.client.ssl.trust.all=true explicitly (which remains available for development against a cluster with a self-signed certificate). After upgrading, a deployment that relied on the implicit trust-all behaviour must either configure a truststore or set trust.all deliberately.

Mitigation if you cannot upgrade

Configure a truststore explicitly wherever SSL is enabled on the Knative HTTP client.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The self-signed keystore is an inert local fixture. Do not use this material against systems you do not own or operate.