CVE-2026-85315 — camel-grpc: consumer exception disclosure

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where, when a route behind a gRPC consumer failed, the route exception's message was copied into the gRPC Status description. Unlike the status cause (withCause(...)), which stays local to the server, the description is transmitted to the calling client, so an external caller able to provoke a failure could read the internal error message — in practice class and package names, file paths, host names and connection detail carried in exception messages (CWE-209). This is the gRPC member of the same unmuted-consumer-exception family as the knative, mina and CXF advisories published alongside it.

Runtime	Directory	Stack
Camel Spring Boot	camel-spring-boot/	Spring Boot 3.5.13 + camel-grpc 4.22.0 (affected; fixed 4.22.1)
Camel Quarkus	camel-quarkus/	Quarkus 3.39.0 + camel-quarkus-grpc (Camel 4.22.0, affected; fixed control CQ 3.40.0 / Camel 4.22.1)

Both modules demonstrate the affected and the fixed behaviour against the real camel-grpc consumer.

What it demonstrates

Each module runs a camel-grpc consumer (the PingPong service from camel-grpc's own test proto) whose route always fails with an internal-looking message:

Internal failure contacting jdbc:postgresql://db.internal.local:5432 (user=svc_admin) [CVE-2026-85315]

The verifier endpoint /exploit/attack plays an external gRPC client: it calls PingSyncSync, catches the StatusRuntimeException, and reports the Status code and description the server sent back.

• Affected: the status description is the route exception's message verbatim — the backing-store URL and service account leak to the client.
• Fixed: the new muteException consumer option defaults to true, so the description is the generic "Exchange processing failed" and the real message never leaves the server (it is kept only in the local-only status cause).

# Camel Spring Boot
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected: description leaks the internal message; >>> PROVEN
docker compose down
# Patched control
mvn clean package -Dcamel.version=4.22.1
java -jar target/cve-2026-85315-grpc-exception-disclosure-0.0.1-SNAPSHOT.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: description is "Exchange processing failed"; >>> Not exploited

# Camel Quarkus
cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack     # affected (Camel 4.22.0): description leaks the internal message
docker compose down
# Patched control: CQ 3.40.0 ships Camel 4.22.1
mvn clean package -Dcamel-quarkus.version=3.40.0 -Dquarkus.platform.version=3.40.0
java -jar target/quarkus-app/quarkus-run.jar &
curl -s http://localhost:8080/exploit/attack     # fixed: description is "Exchange processing failed"

Each module serves the verifier on 8080 and runs the camel-grpc consumer on 50051 inside the same process; only 8080 is published.

Vulnerability Summary

Property	Value
Component	camel-grpc (GrpcMethodHandler, consumer)
CWE	CWE-209 (Generation of Error Message Containing Sensitive Information)
Severity	MEDIUM
Attack vector	An external gRPC client provokes a route failure and reads the transmitted Status description
Impact	Internal error detail (class/package names, paths, host names, connection detail) is disclosed to the caller
Affected Versions	From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1
Fixed Versions	4.18.5, 4.22.1, 4.23.0
JIRA	CAMEL-24478
Credit	Claude Security Scan Tool

Advisory: https://camel.apache.org/security/CVE-2026-85315.html

The Quarkus affected module is built on CQ 3.39.0 (Camel 4.22.0). The patched control is CQ 3.40.0 (Camel 4.22.1).

The fix

GrpcMethodHandler adds a muteException consumer option (default true). When enabled, a failed exchange yields the generic description "Exchange processing failed" in the transmitted status; the route exception is still attached locally through withCause(...), which gRPC does not send to the client. Set muteException=false on the endpoint to restore the previous behaviour.

Mitigation if you cannot upgrade

Map failures onto an explicit status in an onException handler so the framework never copies the exception message into the description.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The "internal" message is a benign placeholder (db.internal.local, svc_admin) and the whole demonstration runs in one process. Do not use this material against systems you do not own or operate.