Apache Camel AWS2-S3 Producer Evaluates Untrusted S3 Object Keys

Apache Camel

Apache Camel AWS2-S3 component has an Expression Language Injection vulnerability, allowing attackers to evaluate untrusted S3 object keys as simple expressions.

Fix it

Apache Camel

On 4.18.xUpgrade to Apache Camel 4.18.5
On 4.22.xUpgrade to Apache Camel 4.22.2

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 13:25 UTC
Fixed in: 4.22.2
4.18.5
Identifiers: CVE-2026-95664
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apache Camel AWS2-S3 Producer Evaluates Untrusted S3 Object Keys
Severity: medium. Patch status: patched.
Affected: Apache Camel
Fixed in: 4.22.2, 4.18.5
Ids: CVE-2026-95664

Apache Camel AWS2-S3 component has an Expression Language Injection vulnerability, allowing attackers to evaluate untrusted S3 object keys as simple expressions.

## Steps
1. Search the repo, its CI and infra config for Apache Camel. If present, report the version in use and whether it's affected.
2. Fix by release line: Apache Camel: 4.22.2; 4.18.5.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Apache Camel | fixed | 4.22.2 | — |
| Apache Camel | fixed | 4.18.5 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-95664") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/347
https://pwned.coffee/i/apache-camel-aws2-s3-producer-evaluates-untrusted-s3-obj-cve-2026-95664

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Apache Camel before 4.22.2 4.22.2 CVE record (CNA) checked 10 Nov
Apache Camel before 4.18.5 4.18.5 CVE record (CNA) checked 10 Nov
Score: CVSS 3.1 5.4 (CNA apache) for CVE-2026-95664
Last checked: 10 Nov 2026, 09:19 UTC

Product	Affected	Fixed in	Source
Apache Camel	before 4.22.2	4.22.2	CVE record (CNA) checked 10 Nov
Apache Camel	before 4.18.5	4.18.5	CVE record (CNA) checked 10 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

seclists.org: CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Follow on X

Totalone coffee