AIKIDO-2026-18983

camel-grpc is vulnerable to Generation of Error Message Containing Sensitive Information

CVE-2026-85315Published 4 days ago

CVE Score

Medium

Generation of Error Message Containing Sensitive Information

TL;DR

Before the fix, the camel-grpc consumer's GrpcMethodHandler put the route exception's message into the gRPC status description returned to the calling client, while the status cause stayed on the server, so a remote gRPC client able to reach the consumer and provoke a route failure could read internal error details such as class names, paths and host names. This covered unary and server-streaming calls when routeControlledStreamObserver was false, its default. The fix adds a muteException consumer option, default true, that returns a generic Exchange processing failed description instead; setting muteException=false restores the old output.

How do I fix this?

Upgrade the org.apache.camel:camel-grpc package to a fixed release on your branch: 4.18.5, 4.22.1.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and run a camel-grpc consumer endpoint reachable by remote gRPC clients without routeControlledStreamObserver, where route failures return exception messages in the status description.