Zero Radar
← feed
HighVulnerabilityupdated 29 Oct 2026, 14:04 UTC

Red Hat Enterprise Linux and Apache Camel: several security flaws

Attackers could crash these systems, bypass security checks, or in some cases run their own code or read and change data. Apache Camel's flaw could let an anonymous remote attacker get around protections.

Official source
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

What happened

Multiple vulnerabilities in Red Hat Enterprise Linux (libXi, libXrender, ansible-collection-redhat-leapp) and Red Hat Build of Apache Camel for Quarkus, plus a separate flaw in Apache Camel A2A that allows bypassing security measures.

Why it is dangerous: Successful exploitation could cause denial of service, bypass security controls, allow arbitrary code execution, and expose or manipulate data. A remote, anonymous attacker may be able to exploit the Apache Camel A2A flaw.

Are you affected?

You are affected if you run Red Hat Enterprise Linux with the listed components, Red Hat Build of Apache Camel for Quarkus, or Apache Camel A2A.

Red Hat Enterprise Linux (libXi, libXrender, ansible-collection-redhat-leapp); Red Hat Build of Apache Camel for Quarkus; Apache Camel A2A (versions unknown)

What to do

  1. Check whether you run Red Hat Enterprise Linux with libXi, libXrender or ansible-collection-redhat-leapp, or Apache Camel / Camel A2A
  2. Apply the vendor security updates from Red Hat and the Apache Camel project as soon as they are available
  3. Restrict network access to affected Camel services until patched

Timeline

  1. 29 Oct 2026, 11:49 UTC
    Publicly disclosed
  2. 29 Oct 2026, 11:49 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 29 Oct 2026, 11:53 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 13:59 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-854d4c27
Disclosed
29 Oct 2026, 11:49 UTC
On Zero Radar
29 Oct 2026, 11:53 UTC (4 min after disclosure)
Last change
29 Oct 2026, 14:04 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Red Hat Enterprise Linux and Apache Camel: several security flaws · Zero Radar