CVE-2026-85251

CVE-2026-85251 is a credential leak in camel-http, Apache Camel's HTTP client component. Apache published the advisory on 15 October 2026. The CVE record and NVD entry followed on 19 October.

It only applies when followRedirects is enabled. Then two paths handed credentials to a redirect target, a host chosen by the remote server.

First, the OAuth2 interceptor ran again on every redirect hop. It re-attached the bearer token to whatever host the redirect named. Second, basic and digest credentials were registered for any host, so they went to the redirect target too.

A remote endpoint, or anyone who can shape its responses, could collect those credentials. It only has to answer with a redirect to a host it controls.

Apache scores it CVSS 3.1 7.5 (High). NVD shows the Apache score and has not added its own.

Affected: 4.0.0 before 4.18.5, and 4.19.0 before 4.22.1. Fixed: 4.18.5, 4.22.1 and 4.23.0. Credentials now go only to the configured host. The 4.14.x line is end of life.

Before you can upgrade, Apache suggests setting followRedirects to false on endpoints that carry credentials. Then handle redirects explicitly in the route.

The advisory credits the Claude Security Scan Tool. A public reproducer repository is published by Andrea Cosentino (oscerd), the Camel PMC member who wrote the fix. ThreatWire did not run it.

The CVE is not in the CISA KEV catalog (catalog 2026.10.23). CISA's SSVC entry sets exploitation to none.

Read the full explainer on the eight Camel and Camel K flaws. The other HTTP producer flaw in this batch is CVE-2026-78164.