CVE-2026-85257 — camel-cxf: SOAP fault information disclosure

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where, when a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, the exception was described back to the SOAP client in the fault: CXF copies the message into the SOAP faultstring (and can be configured to place the stack trace in the fault detail). An external caller able to provoke a failure could therefore read internal detail about the deployment — class and package names, and whatever the exception message carries. Declared faults (annotated @WebFault) are a different matter: those are part of the published contract clients are written against, so they are still reported in full.

Runtime	Directory	Stack
Camel Spring Boot	camel-spring-boot/	Spring Boot 3.5.13 + camel-cxf-soap 4.22.0 (affected; fixed 4.22.1), CXFServlet on Tomcat
Camel Quarkus	camel-quarkus/	Quarkus 3.29.0 + camel-quarkus-cxf-soap (Camel 4.15.0, affected; fixed control CQ 3.40.0 / Camel 4.22.1)

Both modules demonstrate the affected and the fixed behaviour.

What it demonstrates

A CXF SOAP consumer backs a route whose processor throws an undeclared IllegalStateException carrying simulated internal detail (a marker token and a fake internal JDBC URL). The driver acts as a SOAP client: it invokes the service and reads the SOAP fault returned to it.

• Affected: the SOAP fault carries the route exception's message (the internal marker / JDBC URL) — internal deployment detail reaches the caller.
• Fixed: the fault is generic — Exchange processing failed — carrying no class, message or stack trace of the route's exception (the new muteException consumer option defaults to true). A fault the contract declares (@WebFault) would still be returned in full.

# Camel Spring Boot
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected: fault leaks internal detail; >>> PROVEN
docker compose down
# Patched control
mvn clean package -Dcamel.version=4.22.1
java -jar target/cve-2026-85257-cxf-fault-info-disclosure-0.0.1-SNAPSHOT.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: generic fault; >>> Not exploited

# Camel Quarkus
cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected (Camel 4.15.0): fault leaks internal detail
docker compose down
# Patched control: CQ 3.40.0 ships Camel 4.22.1
mvn clean package -Dcamel-quarkus.version=3.40.0 -Dquarkus.platform.version=3.40.0
java -jar target/quarkus-app/quarkus-run.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: generic fault

Vulnerability Summary

Property	Value
Component	camel-cxf (CxfConsumer, SOAP fault building)
CWE	CWE-209 (Generation of Error Message Containing Sensitive Information)
Severity	MEDIUM
Attack vector	A SOAP caller provokes an undeclared route failure and reads the exception detail from the fault
Impact	Information disclosure: exception class/message (internal hostnames, connection strings, route shape) reach an external SOAP caller
Affected Versions	From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1
Fixed Versions	4.18.5, 4.22.1, 4.23.0
JIRA	CAMEL-24477
Credit	Claude Security Scan Tool

Advisory: https://camel.apache.org/security/CVE-2026-85257.html

The Spring Boot module mounts the CXFServlet on the embedded Tomcat (a standalone CXF Jetty transport clashes with the Jetty version Spring Boot manages), so the SOAP endpoint is served at /services/hello on port 8080.

The fix

CxfConsumer adds a muteException consumer option (default true). For an undeclared route failure it now builds the fault from a stand-in Exception("Exchange processing failed") with an empty stack trace, instead of the route's exception — so no class name, message or stack trace reaches the caller. An exception the contract declares (@WebFault) is detected and reported in full, because suppressing it would break the service. Set muteException=false to restore the previous output.

Mitigation if you cannot upgrade

Declare the exceptions the service is allowed to report and map every other failure onto one of them in an onException handler, so no undeclared exception reaches the fault.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The marker token and JDBC URL in the failing route are inert, made-up local fixtures. Do not use this material against systems you do not own or operate.