Unsafe Deserialization in Apache Camel Post-Quantum Cryptography

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with a raw java.io.ObjectInputStream.readObject() and no ObjectInputFilter or class allow-list; the cast to KeyMetadata happens only after readObject() returns, so any readObject() side effects in a crafted object run before the type check. A principal who can write to the AWS Secrets Manager secret that holds this metadata (requiring secretsmanager:PutSecretValue on that secret) could store a crafted serialized object that is deserialized during normal key-lifecycle operations, potentially leading to code execution in the context of the application that manages the keys. This is the same underlyi

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-43867 is a critical deserialization vulnerability in Apache Camel's PQC (Post-Quantum Cryptography) component that allows remote code execution through malicious KeyMetadata objects stored in AWS Secrets Manager. The AwsSecretsManagerKeyLifecycleManager uses unsafe java.io.ObjectInputStream.readObject() without any filtering or class allowlisting, enabling attackers to inject arbitrary serialized Java objects that execute malicious code upon deserialization. This affects any organization using Apache Camel with the PQC component configured for key management, particularly those integrating post-quantum cryptography for future-proofing their infrastructure. The vulnerability is especially dangerous because it chains trusted infrastructure (AWS Secrets Manager) with unsafe deserialization, creating a false sense of security while maintaining a direct exploitation path.

Casky's 446 matching skills detect this attack pattern by mapping unsafe deserialization behaviors across MITRE ATT&CK's execution, persistence, and defense evasion techniques (TA0001, TA0043, TA0002). Claude's extended reasoning identifies the specific red flags: Base64-encoded serialized Java objects in secret storage, absence of ObjectInputFilter configurations, and cast operations on deserialized KeyMetadata without validation. Practitioners using Casky would see findings highlighting dangerous class instantiation chains, unsafe stream reading patterns in key lifecycle managers, and missing input validation on cryptographic metadata sources—allowing security teams to distinguish this critical flaw from standard serialization usage and prioritize remediation before post-quantum infrastructure rollouts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-43867.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-43867

Casky has 446 skills that investigate the attack patterns behind CVE-2026-43867. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn