External risk intelligence

Apache Camel Hazelcast Deserialization Vulnerability Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-78162

The vulnerability exists within the Apache Camel hazelcast component's internal handling of Hazelcast clusters. While network-reachable in some environments, these clusters are typically deployed as internal backend infrastructure or as middleware components within an application stack rather than public-facing services. Public internet exposure is uncommon and generally not the intended deployment pattern for such internal data clusters.

Deserialization

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Apache Camel related to how it handles data within Hazelcast clusters. This issue could allow an attacker to execute arbitrary code on affected systems if they can interact with the cluster. The main concern at this time is to confirm if your environment uses this specific component and is therefore exposed.

Unrestricted data deserialization in Apache Camel.
Allows code execution within Hazelcast clusters.
Confirm relevance and exposure to this component.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by publishing a malicious serialized Java object to a Hazelcast cluster that an affected Apache Camel instance is connected to. This object would then be deserialized without restriction by Hazelcast, leading to remote code execution on the Camel-side. This attack path is facilitated because certain Apache Camel configurations for Hazelcast do not properly restrict deserialization, and Hazelcast clusters are often deployed without default authentication or TLS.

Network access to the Hazelcast cluster.
Publishing a serialized Java object.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker could execute arbitrary code within the Apache Camel application by publishing a malicious serialized Java object to a Hazelcast cluster that the application is attached to. This could occur when using specific configurations of the camel-hazelcast component in client mode or when using `ReplicatedHazelcastAggregationRepository` without a pre-configured Hazelcast instance.

Arbitrary code execution on the server.
Via untrusted data in Hazelcast clusters.
Compromise of the Camel application.

Operational Fix

Recommended remediation, mitigation, and detection steps

Apache Camel users with the hazelcast component should engage their platform or application owners to confirm deployment scope and criticality. The immediate next step is to identify all Camel instances using hazelcast, assess their network exposure and business impact, and then plan remediation, potentially involving vendor coordination for upgrades.

Application and platform teams own remediation.
Verify hazelcast component usage and reachability.
Plan upgrades or apply explicit Hazelcast configuration.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Apache Camel hazelcast component?

Apache Camel is an integration framework used to connect various software systems. The camel-hazelcast component specifically allows Camel to interact with Hazelcast, an in-memory data grid used for distributed caching, messaging, and state management. Developers use it to share data across multiple application instances, but this component can inadvertently create security gaps if its communication settings are not properly constrained during instance creation.

How does this CVE-2026-78162 vulnerability work?

This vulnerability is a Deserialization of Untrusted Data issue (CWE-502). It occurs when the software takes data from an untrusted source—in this case, a Hazelcast cluster—and turns it back into a Java object without checking if that data is malicious. Because the affected Camel components fail to apply security filters, an attacker can send a crafted object that forces the application to execute arbitrary code on the server, resulting in full system compromise.

Do I need to be directly connected to the Camel application to trigger this?

Not necessarily. The attack is triggered by publishing malicious objects into the Hazelcast cluster that the Camel instance is connected to. The vulnerability does not require interaction with the Camel application's public-facing APIs. However, the attacker must have network access to the Hazelcast cluster itself. If the cluster is isolated and not accessible from outside your network, an attacker cannot reach it to inject the malicious data.

Is my deployment relevant for this CVE-2026-78162?

Relevance depends on whether you use the affected camel-hazelcast component and how your network is structured. Halo Surface Signal notes that while the vulnerability is critical, these clusters are often internal middleware. If your Hazelcast cluster is tucked away as backend infrastructure, it is less likely to be directly reachable from the public internet, though you remain at risk from internal threats or compromised systems that can reach the cluster's network segment.

When should I upgrade or change my configuration?

You should prioritize this immediately if you use Apache Camel with Hazelcast. The primary fix is upgrading to versions 4.23.0, 4.22.1, or 4.18.5. If you cannot upgrade right away, you must manually secure your Hazelcast instances. You can do this by injecting a pre-built HazelcastInstance that already includes a JavaSerializationFilterConfig, which restricts which classes can be deserialized, effectively closing the insecure path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.