Camel Spring Redis deserialization RCE (CVE-2026-78165) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-78165 is a high-severity deserialization flaw in Apache Camel Spring Redis (2.11.0 before 4.18.5, and 4.19.0 before 4.22.1) that lets anyone able to publish to a subscribed Redis channel execute arbitrary code on the Camel host. Fixed in 4.23.0, with backports in 4.22.1 and 4.18.5.

Overview

The Spring Redis component ships with a default Java serializer. When no serializer option is configured, RedisConfiguration.getSerializer builds a bare JdkSerializationRedisSerializer and reuses that single instance for every read. Spring’s implementation hands the bytes to DefaultDeserializer, which reads them through a ConfigurableObjectInputStream with no java.io.ObjectInputFilter attached. Any serialized class graph is therefore instantiated and its readObject method runs.

Two paths reach that sink:

• Consumer path. RedisConsumer.setBody deserializes the raw bytes of every message delivered on subscribed channels, before the Exchange exists, so route logic never gets a chance to inspect the payload. Anyone who can issue PUBLISH on a subscribed channel reaches the sink directly.
• Template path. The default RedisTemplate built by RedisConfiguration.createDefaultTemplate shares the same serializer, so producer commands GET, HGET, HGETALL and HVALS deserialize whatever sits in the keyspace. SpringRedisIdempotentRepository uses that template as well.

Wiring a custom redisTemplate with a String serializer does not close the consumer path, because setBody reads getSerializer directly rather than the template’s serializer. Deployments in that shape stay exposed until the serializer option itself is set.

Impact

Successful exploitation runs attacker-supplied code in the Camel process, with the privileges of that process. No authentication is required beyond the ability to publish or write to Redis. An internal foothold, a misconfigured or unauthenticated Redis instance, or a shared channel namespace is enough. A public proof-of-concept exists; CISA KEV does not list the CVE, so no confirmed in-the-wild use has been reported.

Remediation

Upgrade to 4.23.0. On the 4.22.x line use 4.22.1; on 4.18.x use 4.18.5. The 4.14.x line and earlier are end of life and will not be fixed, so those deployments must move to a supported release.

If you cannot upgrade immediately:

• Set the JVM-wide jdk.serialFilter system property, for example -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!*.
• Set the serializer endpoint option to a serializer that avoids Java serialization, such as StringRedisSerializer. Setting it on a custom template alone is not sufficient.
• Require authentication on Redis, restrict which clients may publish to subscribed channels, and keep the instance off untrusted networks.

The related ActiveMQ KEV entry shows how quickly messaging middleware exposure becomes a priority.

Security Insight

This bug sat undetected since 2.11.0 because the component never constructs a java.io.ObjectInputStream itself, so static sweeps for unfiltered Java deserialization in Camel never flagged it. That is the real lesson: the dangerous gadget lives one abstraction layer down, inside Spring’s converter chain, and reviewer heuristics that grep for direct stream construction will keep missing it. Treat “we audited our deserialization sinks” claims with suspicion until the transitive serializers are on the list too.

Further Reading

• Apache ActiveMQ CVE-2026-34197 added to CISA KEV catalo
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs