Sploitus

Exploit for CVE-2026-56139

kitploit · 2026-08-25

Exploit Code

MARKDOWN12 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-56139
# camel-undertow Rest DSL muteException Stack-Trace Disclosure Reproducer (CVE-2026-56139)

This project demonstrates an **information-disclosure** issue in Apache Camel's `camel-undertow` **Rest DSL** consumer, tracked as **CVE-2026-56139**. The `muteException` option controls whether an uncaught processing exception's detail is returned to the HTTP client. On a plain undertow endpoint the option works — but the undertow **Rest DSL** creates its response binding with `muteException` **hard-coded to false** and never copies the configured value, so `muteException` is **silently ignored in REST mode** and the full Java stack trace is returned anyway:

root@kitploit:~
    
    
    // UndertowComponent (affected 4.18.2) — the Rest DSL binding is created without the endpoint's muteException
    if (!map.containsKey("undertowHttpBinding")) {
        endpoint.setUndertowHttpBinding(new RestUndertowHttpBinding(endpoint.isUseStreaming()));  // muteException stays false
    }