Apache Camel Hazelcast deserialization RCE (CVE-2026-78162) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-78162 is a critical unauthenticated deserialization vulnerability in Apache Camel 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1 that grants remote code execution to anyone able to write into the Hazelcast cluster the affected instance joins. Patched in 4.23.0, 4.22.1 and 4.18.5 - upgrade immediately.

Overview

CVE-2026-78162 is a deserialization of untrusted data flaw in Apache Camel’s camel-hazelcast component. An earlier fix, CVE-2026-43865, added a default Hazelcast JavaSerializationFilterConfig to instances Camel creates from its own configuration. Two configuration paths were missed.

First, ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block. A route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values from the backing ReplicatedMap with no class restriction.

Second, HazelcastDefaultComponent#getOrCreateHzClientInstance() builds its own ClientConfig when hazelcastMode=client is selected and neither a referenced ClientConfig nor hazelcastConfigUri is supplied. That path applied no filter either, so client-mode endpoints behaved differently from node-mode endpoints for an otherwise identical configuration.

The CVSS score is 10.0: network attack vector, low complexity, no privileges, no user interaction.

Impact

An attacker who can publish into the Hazelcast cluster can cause a serialized Java object of their choosing to be deserialized inside Hazelcast’s own serialization layer, before Camel processes the exchange. The result is remote code execution on the Camel host.

Two factors widen exposure. Hazelcast clusters ship without authentication and without TLS by default, and selecting client mode is a topology choice rather than a security decision. Neither path required a deployment to opt in to unsafe behaviour.

Any Camel deployment using camel-hazelcast aggregation repositories or client-mode endpoints without an explicit Hazelcast configuration should be treated as exposed.

Remediation

Upgrade to a fixed release:

• 4.23.0 for all current users.
• 4.22.1 for the 4.22.x stream.
• 4.18.5 for the 4.18.x stream.

The 4.14.x stream and earlier reached end of life before this issue was resolved and will not receive a fix. Deployments on those lines must move to a supported release.

If you cannot upgrade immediately:

• Supply an explicit Hazelcast configuration carrying a JavaSerializationFilterConfig, or inject a pre-built HazelcastInstance. Camel never overwrites a user-supplied configuration.
• Set the JVM-wide filter -Djdk.serialFilter=!java.net.;java.;javax.;org.apache.camel.;!* .
• Enable Hazelcast cluster authentication and TLS to restrict who can reach the cluster.

Audit routes for ReplicatedHazelcastAggregationRepository usage and for hazelcastMode=client endpoints, since these are the two affected paths.

Security Insight

This is a patch-completeness failure rather than a design failure. CVE-2026-43865 got the fix right in intent, but two hand-copied bootstrap blocks meant the hardened default applied unevenly - a pattern that recurs wherever a framework duplicates configuration logic instead of centralizing it. Contrast this with the long-running ActiveMQ deserialization issues, where CVE-2026-34197 was added to the CISA KEV catalog after exploitation began. Camel’s fix landed before that point, but teams relying on the earlier patch should verify their specific configuration path was actually covered.

Further Reading

• Apache ActiveMQ CVE-2026-34197 added to CISA KEV catalo
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs