Loading vulnerability…
CVE-2026-88789 is an XML External Entity vulnerability in the Apache Camel Quarkus XSLT support extension, camel-quarkus-support-xalan. The extension installs an Xalan-J 2.7.x-backed TransformerFactory for the Camel XSLT component and as the default JAXP TransformerFactory. Because Xalan-J 2.7.x does not honor the JAXP external-DTD and external-stylesheet access restrictions, Apache Camel's intended restrictions are ineffective. An attacker able to supply an XML document for transformation can use an external entity declaration to read local files or cause requests to internal network locations. On the Camel XSLT path, the affected input is a message body already represented as javax.xml.transform.Source; other body types are converted to hardened SAXSource instances with external entities and external DTD loading disabled. The default factory registration can also affect other application code that obtains a TransformerFactory through TransformerFactory.newInstance().
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This is a runnable, self-contained Java/Maven proof of concept for CVE-2026-88789, an XXE/external-access restriction failure in Apache Camel Quarkus's camel-quarkus-support-xalan integration. The project contains a Camel Quarkus 3.36.0 application, Docker build/compose files, an XSLT route, a benign stylesheet, a local secret-file setup component, internal test endpoints, and a JAX-RS attacker driver. The vulnerable route is from("direct:transform").to("xslt:copy-data.xsl"). ExploitResource sends controlled XML as a StreamSource so Camel passes it to the Xalan-backed transformer without the hardened SAX conversion applied to non-Source bodies. The probes demonstrate file disclosure via a file: external entity, SSRF and response reflection via an HTTP external entity, and retrieval of an external DTD. It also demonstrates that TransformerFactory.newInstance() selects Camel Quarkus's Xalan factory and that attempts to set ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET are rejected. InternalResource logs parser-generated accesses to /internal/secret and /internal/leak.dtd, while SecretFile creates the local disclosure target. The repository is a functional educational reproducer rather than a scanning-only script; fixed Camel Quarkus versions 3.33.3 and 3.40.0 are documented as no longer reproducing the issue.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.