Key points
- CVE-2026-83531 carries a CVSS score of 8.8, rated as HIGH severity.
- Affected versions include 4.4.0 through 4.18.4 and 4.19.0 through 4.22.0.
- Fixes are available in versions 4.23.0, 4.22.1, and 4.18.5.
Apache Camel versions 4.4.0 through 4.18.4 and 4.19.0 through 4.22.0 contain a high-severity vulnerability, CVE-2026-83531, that allows remote code execution. The Apache Software Foundation has released patches for these streams in versions 4.23.0, 4.22.1, and 4.18.5. Deployments on end-of-life lines like 4.14.x will not receive a fix and must migrate to supported releases to resolve this issue.
In plain English
This flaw lets attackers inject malicious code into the application. The dynamic-router-control feature allows systems to manage message routing by sending control messages. When processing these messages, the system reads expression language and predicates directly from the incoming data. It compiles and runs this code without checking if it is safe or if the sender is authorized.
The background
The vulnerability exists because the system trusts input from external transports. If a route forwards messages from an external source to the control endpoint, any actor on that transport can supply their own expression. This code runs with the privileges of the Camel process. The simple language, which is always present, was the default, meaning removing optional languages from the classpath does not prevent exploitation.
What changes now
Version 4.23.0 introduces a new security option called allowPredicateFromMessage. By default, this option is disabled, so control messages carrying predicate expressions or language names are rejected. Administrators must explicitly enable this feature only when they trust every sender of control messages. This change forces route authors to define predicates in the configuration rather than accepting them from dynamic message headers.
Who needs to act first
Teams should prioritize updating systems that expose the dynamic-router-control endpoint to external or shared network transports. Before rolling out the patch, test the update in a staging environment to ensure routing logic remains intact. Back up current configurations to allow for quick rollback if issues arise. For systems that cannot be updated immediately, teams usually isolate the control endpoint from untrusted networks and restrict access to only internal, authenticated services.
What to do and how to stay safe: Apache Camel
- Verify if your environment uses the dynamic-router-control endpoint with Apache Camel versions prior to 4.23.0.
- Upgrade to version 4.23.0, 4.22.1, or 4.18.5 as soon as possible to apply the vendor fix.
- If upgrading is not immediately possible, prevent external messages from reaching the control endpoint.
- Remove CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers from incoming messages if they must cross untrusted transports.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is CVE-2026-83531 being exploited in the wild?
The source material does not state whether this vulnerability is currently being exploited in the wild.
Can removing optional expression languages fix this issue?
No, the simple language is always present and was the default, so removing optional languages is not a sufficient workaround.
Which Apache Camel versions are affected?
Versions 4.4.0 to 4.18.4 and 4.19.0 to 4.22.0 are affected.
