CVE-2026-46590 — camel-pqc Key-Lifecycle Unsafe Deserialization

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Both are affected versions (fixed in 4.18.3 / 4.21.0), and both demonstrate the identical defect: FileBasedKeyLifecycleManager persists post-quantum keys as PKCS#8/X.509 JSON, but still migrates legacy (Java-serialized) key files back with a raw ObjectInputStream and no ObjectInputFilter — the incomplete-remediation residue of CVE-2026-40048. getKey(keyId) falls back to migrateLegacyKey(), which deserializes the attacker-planted <keyId>.key file; the cast to KeyPair happens only after readObject() returns, so a crafted object executes first (CWE-502).

Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README. In short, for either:

cd camel-spring-boot   # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-46590.html

Disclaimer

These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.