CVE-2026-33453 -- CVSS 10.0 Vulnerability Briefing

CVE-2026-33453 | CVSS 10.0 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-33453 is a critical-severity improper control of dynamically-determined object attributes vulnerability in the camel-coap component of Apache Camel, a widely used open-source integration framework.

Technical Detail

The flaw resides in how the camel-coap component processes incoming Camel message headers, allowing an attacker to manipulate dynamically-determined object attributes through crafted CoAP protocol messages. This class of vulnerability, sometimes referred to as mass assignment or prototype pollution depending on implementation context, can enable an attacker to modify internal object state in ways not intended by the application, potentially leading to unauthorized behavior, privilege escalation, or remote code execution depending on how the affected attributes are consumed downstream. The vulnerability carries a CVSS score of 10.0, indicating it is likely exploitable without authentication and with no user interaction required, though full technical details of the attack chain have not yet been publicly confirmed.

Exploitation Status

No known exploit code has been observed or confirmed as of May 4, 2026. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit at this time, meaning no public proof-of-concept or operational exploit has been documented. Given the critical CVSS score, this should be treated as a high-priority patching target regardless of current exploitation status.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns, targeted sectors, or adversary groups have been linked to this vulnerability as of the date of this briefing.

What To Do

Organizations using Apache Camel with the camel-coap component should apply the vendor-supplied patch as soon as it becomes available and treat this as an urgent remediation given the maximum CVSS score. If patching cannot be applied immediately, consider disabling or restricting access to any services or endpoints that rely on the camel-coap component, and enforce network-level controls to limit exposure of CoAP endpoints to trusted sources only. Monitor Apache Camel's official security advisories at camel.apache.org for patch release details and version guidance. Review application logs for anomalous CoAP message patterns or unexpected object attribute modifications as a detection signal while awaiting a patch.