Can you post details where it was logged.
In the Camel codebase we have logic which masks password fields from endpoints, if endpoints are logged.
So we need to know exactly there its logged and presented in clear-text.
What version of SMX and Camel are you using?
I am using apache-servicemix-4.2.0-fuse-02-00 and
indicated in the pom.xml is <camel-version>2.5.0</camel-version>
This appear in the servicemix.log where the password had been auto decrypted:
10:37:58,882 | INFO | 4: FileComponent | RemoteFileProducer | t.file.remote.RemoteFileProducer 175 | Connected and logged in to: Endpoint\[ftp://firstname.lastname@example.org/ftp/?password=amelia\]
There is no official releases of Fuse ESB which provides Camel 2.5 or better.
I think there is a Fuse ESB 4.3.1 planned which will use Camel 2.5 or better.