CVE-2026-49042: LangChain input validation flaw

Q: Is CVE-2026-49042 actively exploited?

No confirmed active exploitation of CVE-2026-49042 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-49042?

1) Upgrade org.apache.camel:camel-spring-ai-tools, camel-langchain4j-agent, and camel-langchain4j-tools to 4.18.3 (for the 4.8.0–4.18.2 line) or 4.21.0 (for 4.19.0–4.20.0) — this is a targeted dependency-level fix, not a full Camel upgrade. 2) Inventory Maven builds specifically for these three artifact names since standard Camel BOM scans may not flag them as high-priority. 3) Until patched, restrict network exposure of any endpoint that surfaces Camel routes as AI agent tools (place behind authentication/network segmentation even though the vulnerability itself needs none). 4) Add schema/allow-list validation in front of agent-exposed tool endpoints as defense in depth. 5) Monitor integration logs for malformed or anomalous tool-call payloads hitting these components as a detection signal.

Q: What systems are affected by CVE-2026-49042?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI tool-calling integration pipelines, enterprise system integration (ESB/iPaaS).

Q: What is the CVSS score for CVE-2026-49042?

CVE-2026-49042 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.69%.

CISO Take

Apache Camel's AI agent tool integration components — camel-spring-ai-tools, camel-langchain4j-agent, and camel-langchain4j-tools — fail to properly validate input (CWE-20), rated High at CVSS 7.3 with a network vector requiring no authentication or user interaction. These are the exact components organizations use to expose internal Camel routes as callable tools for LangChain4j or Spring AI agents, so any deployment wiring LLM tool-calling into enterprise integration pipelines is in scope. Camel sits upstream of 3,030 downstream dependents and already carries 57 other CVEs in its history, so patch discipline in this ecosystem matters, though the EPSS score of 0.0069 (top 50th percentile) and absence from CISA KEV or public exploit/Nuclei coverage indicate no evidence of active or imminent exploitation today. Upgrade to Camel 4.18.3 or 4.21.0 for the three affected artifacts, and until then treat any network-reachable AI-agent-tool endpoint as untrusted input requiring perimeter validation and monitoring for malformed tool-call payloads.

Sources:NVDEPSSOpenSSFATLAScamel.apache.org

What is the risk?

The vulnerability is network-exploitable with low attack complexity, no privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N), which raises exploitability, but the resulting confidentiality, integrity, and availability impacts are each rated low (C:L/I:L/A:L), capping the overall severity at High rather than Critical. Real-world exposure depends on whether an organization has actually deployed Camel's AI agent tool components (relatively new, introduced from Camel 4.8.0) to bridge LLM agents with backend Camel routes — adoption is likely narrower than Camel's broad base of 3,030 downstream dependents. No public exploit, Nuclei template, or KEV listing exists, and EPSS sits at a low absolute value (0.69%) despite being in the top half of the percentile distribution, so this reads as a proactive-patch item rather than an active-exploitation emergency.

How does the attack unfold?

Entry point

Attacker reaches a network-facing endpoint that exposes a Camel route as a callable tool for a LangChain4j or Spring AI agent, requiring no authentication or user interaction.

AML.T0049

Exploitation

Malformed or crafted input passed through camel-langchain4j-agent/tools or camel-spring-ai-tools is not properly validated (CWE-20) and is processed by the underlying Camel route.

AML.T0053

Impact

The unvalidated input causes limited unauthorized effects on confidentiality, integrity, or availability of the backend systems the Camel route integrates with.

Entry point

Attacker reaches a network-facing endpoint that exposes a Camel route as a callable tool for a LangChain4j or Spring AI agent, requiring no authentication or user interaction.

AML.T0049

Exploitation

Malformed or crafted input passed through camel-langchain4j-agent/tools or camel-spring-ai-tools is not properly validated (CWE-20) and is processed by the underlying Camel route.

AML.T0053

Impact

The unvalidated input causes limited unauthorized effects on confidentiality, integrity, or availability of the backend systems the Camel route integrates with.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangChain	maven	>= 4.8.0, < 4.18.3	`4.18.3`
148.8KOpenSSF 5.73.2K dependentsPushed 2d ago30% patched~164d to patchFull package profile →
LangChain	maven	>= 4.8.0, < 4.18.3	`4.18.3`
148.8KOpenSSF 5.73.2K dependentsPushed 2d ago30% patched~164d to patchFull package profile →
LangChain	maven	>= 4.8.0, < 4.18.3	`4.18.3`
148.8KOpenSSF 5.73.2K dependentsPushed 2d ago30% patched~164d to patchFull package profile →

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) Upgrade org.apache.camel:camel-spring-ai-tools, camel-langchain4j-agent, and camel-langchain4j-tools to 4.18.3 (for the 4.8.0–4.18.2 line) or 4.21.0 (for 4.19.0–4.20.0) — this is a targeted dependency-level fix, not a full Camel upgrade. 2) Inventory Maven builds specifically for these three artifact names since standard Camel BOM scans may not flag them as high-priority. 3) Until patched, restrict network exposure of any endpoint that surfaces Camel routes as AI agent tools (place behind authentication/network segmentation even though the vulnerability itself needs none). 4) Add schema/allow-list validation in front of agent-exposed tool endpoints as defense in depth. 5) Monitor integration logs for malformed or anomalous tool-call payloads hitting these components as a detection signal.

How is it classified?

Data LeakageDoSAgentFrameworkAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluation

OWASP LLM Top 10

LLM06:2025-Excessive Agency

Frequently Asked Questions

What is CVE-2026-49042?

Apache Camel's AI agent tool integration components — camel-spring-ai-tools, camel-langchain4j-agent, and camel-langchain4j-tools — fail to properly validate input (CWE-20), rated High at CVSS 7.3 with a network vector requiring no authentication or user interaction. These are the exact components organizations use to expose internal Camel routes as callable tools for LangChain4j or Spring AI agents, so any deployment wiring LLM tool-calling into enterprise integration pipelines is in scope. Camel sits upstream of 3,030 downstream dependents and already carries 57 other CVEs in its history, so patch discipline in this ecosystem matters, though the EPSS score of 0.0069 (top 50th percentile) and absence from CISA KEV or public exploit/Nuclei coverage indicate no evidence of active or imminent exploitation today. Upgrade to Camel 4.18.3 or 4.21.0 for the three affected artifacts, and until then treat any network-reachable AI-agent-tool endpoint as untrusted input requiring perimeter validation and monitoring for malformed tool-call payloads.

Is CVE-2026-49042 actively exploited?

No confirmed active exploitation of CVE-2026-49042 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-49042?

1) Upgrade org.apache.camel:camel-spring-ai-tools, camel-langchain4j-agent, and camel-langchain4j-tools to 4.18.3 (for the 4.8.0–4.18.2 line) or 4.21.0 (for 4.19.0–4.20.0) — this is a targeted dependency-level fix, not a full Camel upgrade. 2) Inventory Maven builds specifically for these three artifact names since standard Camel BOM scans may not flag them as high-priority. 3) Until patched, restrict network exposure of any endpoint that surfaces Camel routes as AI agent tools (place behind authentication/network segmentation even though the vulnerability itself needs none). 4) Add schema/allow-list validation in front of agent-exposed tool endpoints as defense in depth. 5) Monitor integration logs for malformed or anomalous tool-call payloads hitting these components as a detection signal.

What systems are affected by CVE-2026-49042?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI tool-calling integration pipelines, enterprise system integration (ESB/iPaaS).

What is the CVSS score for CVE-2026-49042?

CVE-2026-49042 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.69%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI tool-calling integration pipelinesenterprise system integration (ESB/iPaaS)

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

Exploitation Scenario

An organization exposes a Camel route as a callable tool for a LangChain4j or Spring AI agent (e.g., a customer-support agent that can query internal systems via a Camel-mediated tool). An attacker — either a party with direct network access to the tool-invocation endpoint, or an adversary who has achieved indirect prompt injection against the LLM driving the agent — crafts an input that the vulnerable camel-langchain4j-tools/agent or camel-spring-ai-tools component fails to validate. Because no authentication or user interaction is required at the network layer, this malformed input reaches the underlying Camel route and causes it to process or act on unintended data, resulting in limited unauthorized disclosure, modification, or disruption of the backend system the route integrates with.

Weaknesses (CWE)

CWE-20Improper Input ValidationPrimary

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.