CVE-2026-56139

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.57% · Oct 25, 2026

A flaw was found in the Apache Camel Undertow component. The `camel-undertow` HTTP server consumer, when processing errors, could return full Java stack traces in HTTP responses. This occurs because the `muteException` option, which controls what is returned to the client during errors, defaulted to `false`. An unauthenticated attacker could exploit this by sending a malformed request, leading to the disclosure of sensitive internal information such as credentials, internal network details, and application structure, which could aid in further attacks. org.apache.camel/camel-undertow: Apache Camel Undertow: Information disclosure via error messages containing sensitive data This Moderate impact information disclosure flaw in Apache Camel Undertow allows unauthenticated attackers to obtain sensitive internal system details. By default, the `camel-undertow` HTTP server consumer returns full Java stack traces in error responses, which can expose credentials, internal network configurations, and application structure. This is particularly relevant for Red Hat deployments utilizing `camel-undertow` where such endpoints are publicly accessible, as the `muteException` option was not honored for Rest DSL consumers in affected versions. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.