CVE-2026-95664 in Apache Camel AWS2-s3

Expression injection in Camel AWS2-s3 enables credential access via S3 object keys. CVSS 5.4 medium.

CVE-2026-95664 is an expression language injection in Apache Camel's AWS2-s3 component. When a route consumes from S3 and produces to another bucket, object names are evaluated as Simple expressions if they contain ${ or $simple{. An attacker uploading manipulated names can execute expressions in Camel. Expressions access system properties, environment variables, configuration (often with credentials) and, with camel-bean, can invoke methods on beans in the registry.

With CVSS 5.4 (medium), severity is medium because attackers need write access to a consumed bucket. However, security implications are significant: the flaw extracts credentials from environment variables and configuration. Patch available October 26, 2026 (NVD date), with public proof-of-concept on GitHub October 29 for Camel Spring Boot and Quarkus, signaling community interest.

Administrators must verify if Camel 4.8.0+ with aws2-s3 is in use. On supported versions (4.18.x, 4.22.x, 4.23.0+) plan upgrades to: 4.18.5, 4.22.2, 4.23.0+. If immediate upgrade is not feasible: remove the CamelAwsS3Key header using removeHeader() before the producer, or reject exchanges with ${ or $simple{ in the header. Restrict write access to consumed buckets to trusted principals only.

At a glance

What: Expression Language Injection in Apache Camel's AWS2-s3 component. A route that consumes objects from S3 and produces them to another bucket evaluates the object name as a Simple expression if it contains ${ or $simple{. An attacker who can upload files to a bucket can execute expressions in the Camel process.
Severity: CVSS 5.4 (medium). Impact is limited by the requirement to upload objects to the consumed bucket. However, expressions can access system properties, environment variables, and invoke methods on beans (if camel-bean is on the classpath), potentially exposing credentials.
Affected versions: Versions from 4.8.0 (until before 4.18.5) and from 4.19.0 (until before 4.22.2). Versions 4.8.x, 4.17.x, 4.19.x, 4.21.x have reached end-of-life and will not receive patches.
Fix: Upgrade to version 4.23.0 (or 4.22.2 for 4.22.x, or 4.18.5 for 4.18.x). After upgrade, names provided via CamelAwsS3Key header are used literally. Routes that evaluated Simple expressions in the header must evaluate them explicitly with setHeader and simple().
Status: Reported October 26, 2026. Public reproducer available on GitHub since October 29, 2026. Patch immediately available for supported versions. End-of-life for versions 4.8.x-4.17.x and 4.19.x-4.21.x.
Action: Check if Camel and aws2-s3 component are in use. If yes: identify versions in production and test the patch. If immediate upgrade is not feasible: remove CamelAwsS3Key header before AWS2-s3 producer using removeHeader(), or reject exchanges containing ${ or $simple{ in the header. Restrict write access to consumed buckets to trusted principals only.

Sources: NVD, CVE-2026-95664

← All articles