Apache Camel Patches 38 Security Advisories, Including 28 AI-Reported Findings

Apache Camel released fixes associated with 38 security advisories, including 28 findings credited to the Claude Security Scan Tool through Project Glasswing and 10 reported by human researchers. The issues include configuration-dependent issuer-validation weaknesses in Keycloak integration and shared authentication-token caching that could cause connections to use inappropriate tokens. Users should upgrade to supported releases 4.18.5, 4.22.1, or 4.23.0. The end-of-life 4.14.x branch is affected by 35 advisories and will not receive these fixes. Camel's announcement does not report an active attack campaign.

One advisory, CVE-2026-78162, addresses missing default deserialization filtering in two internally built Hazelcast configuration paths: ReplicatedHazelcastAggregationRepository and client-mode endpoint ClientConfig creation. It follows an incomplete fix for CVE-2026-43865, meaning deployments upgraded to 4.14.8, 4.18.3, or 4.21.0 remained exposed through those paths. The correction extends Camel's use of Hazelcast-provided protections; it does not address a flaw in Hazelcast's own deserialization code, and user-supplied configurations and Hazelcast instances remain unchanged. Administrators should review those configurations separately and migrate unsupported branches. The AI-assisted findings produced actionable fixes, but the reported results do not establish scanner accuracy or demonstrate that automated scanning can replace human security review.