Apache Camel vulnerabilities

A vulnerability in the Apache Camel Knative component allows an unauthenticated attacker to inject Camel-internal headers (e.g., CamelHttpUri, CamelHttpPath, CamelFileName) via a structured-mode CloudEvent request. This occurs because CloudEvent extension attributes are copied to Exchange headers without filtering, enabling override of configured values in routes forwarding messages to header-driven components such as camel-http or camel-file.

A relative path traversal vulnerability in the Apache Camel Azure-Storage Datalake component allows writing files outside the configured target directory during the downloadToFile operation. Remote file names with parent-directory segments are not normalized or checked, enabling creation or overwriting of files at arbitrary locations accessible to the Camel process.

Vulnerability in Apache Camel involves improper input validation in the camel-mail component. When MimeMultipart data format is configured with headersInline=true, MIME headers from the message are copied to Camel headers without filtering, allowing an attacker to inject headers from Camel's internal namespace and override component behavior.

Improper Input Validation vulnerability in Apache Camel. The flaw allows potential attacks via malicious input data.

An improper input validation vulnerability has been discovered in Apache Camel. This flaw allows an attacker to inject malicious data, potentially leading to unexpected application behavior.

An improper input validation vulnerability has been discovered in Apache Camel. This flaw allows an attacker to inject malicious data, potentially leading to unexpected application behavior.

Vulnerability in Apache Camel Undertow component causes sensitive information disclosure by returning full stack traces in HTTP responses. The muteException option defaults to false, exposing detailed exceptions on route processing errors. Rest DSL consumers ignore this option entirely, always returning stack traces.

A vulnerability in the Atmosphere Websocket component of Apache Camel allows an attacker to inject internal Camel control headers via WebSocket query parameters. This leads to Server-Side Request Forgery (SSRF) and exposure of sensitive information such as environment variables, application properties, and vault secrets.

A vulnerability in the Apache Camel Netty HTTP component causes the muteException option to default to false, returning full stack traces in HTTP responses on processing errors. Unauthenticated clients can thus obtain sensitive internal information like credentials, filesystem paths, and dependency versions.

A vulnerability in Apache Camel Salesforce component allows an attacker to inject arbitrary SOQL/SOSL queries, override the target SObject, or redirect Apex REST calls by setting control headers in an HTTP request. This occurs because the headers lack the 'Camel' prefix and are not blocked by HttpHeaderFilterStrategy, allowing them to pass from an HTTP request into the Salesforce producer.

A vulnerability in the Apache Camel Kafka component allows an attacker to override the target Kafka topic via the `kafka.OVERRIDE_TOPIC` header in an HTTP request. Due to improper input validation and neutralization of special elements, in routes bridging an HTTP consumer to a Kafka producer, any HTTP client can redirect messages to arbitrary Kafka topics, including sensitive internal ones. Affected versions: Apache Camel from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.

A vulnerability in the Apache Camel IRC component allows an attacker to inject control headers (e.g., irc.sendTo) via untrusted HTTP input, redirecting IRC messages to an arbitrary channel or user. The issue stems from improper input validation and lack of special element neutralization in headers that bypass the HTTP filter strategy.

A vulnerability in the DAPR component of Apache Camel allows an attacker to redirect messages to arbitrary Dapr Pub/Sub components and topics. This is due to improper validation of the CamelDaprPubSubName and CamelDaprTopic headers, which are copied from inbound CloudEvents and used as producer routing.

A vulnerability in Apache Camel's Vertx Websocket component allows an attacker to inject Camel control headers, including CamelHttpUri, via WebSocket query parameters. This leads to server-side request forgery (SSRF) and exposure of sensitive information such as environment variables, application properties, and vault secrets. Affected versions: 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, and 4.19.0 to 4.20.0.

A vulnerability in the Apache Camel CXF SOAP component allows an attacker to manipulate the operationName/operationNamespace headers to invoke an unintended WSDL operation on the backend. The lack of a Camel prefix in these headers prevents filtering at the HTTP boundary, allowing them to pass from an HTTP request into the Exchange. This enables a confused-deputy attack where a read operation can be replaced with a destructive one.

A vulnerability in the Neo4J component of Apache Camel allows Cypher injection through property names in the CamelNeo4jMatchProperties map. Although property values are bound as parameters, JSON key names are concatenated verbatim into the query, enabling an attacker to alter the query structure and perform arbitrary operations on the Neo4j database.

Untrusted data deserialization vulnerability in Apache Camel's PQC component allows remote code execution via a crafted Java object. The flaw stems from missing input filtering when reading post-quantum key metadata from HashiCorp Vault, AWS Secrets Manager, and local file backends.

A vulnerability in the Apache Camel Lucene component allows improper input validation and authorization bypass via a user-controlled key. An attacker can set the QUERY header in an HTTP request to execute arbitrary Lucene queries, including reading the entire index or performing expensive regex queries, without proper credentials.

A vulnerability in Apache Camel Mail component allows an attacker to inject headers from the mail.smtp.* or mail.smtps.* namespace, potentially redirecting the SMTP connection to an attacker-controlled server (pre-4.19.0) or weakening transport security (newer versions). The issue stems from missing HeaderFilterStrategy filtering and the producer interpreting these headers.

Improper input validation in Apache Camel's camel-nats component allows injection of Camel control headers via NATS messages. The missing header filtering lets attackers modify Camel route behavior, such as redirecting HTTP requests or changing file names.

In Apache Camel's camel-elasticsearch-rest-client component, improper input validation allows an attacker to bypass authorization via user-controlled headers. Unprefixed header names (e.g., SEARCH_QUERY, OPERATION) bypass the HTTP header filter, enabling remote manipulation of Elasticsearch queries without authentication.

A vulnerability in Apache Camel (JMS components) allows deserialization of untrusted data by bypassing the CVE-2026-40860 fix. An attacker can publish a JMS ObjectMessage with a DefaultExchangeHolder object, which passes the allow-list check, and then write arbitrary data into the Camel Exchange, manipulating routing, headers, and properties.

Deserialization of untrusted data vulnerability in Apache Camel Hazelcast component. The default Hazelcast configuration applies no deserialization filter, allowing an attacker to achieve remote code execution by sending a crafted Java object to the Hazelcast cluster. Affects versions 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, and 4.19.0 before 4.21.0.

Deserialization of untrusted data vulnerability in Apache Camel allows an attacker to trigger DNS queries by delivering a crafted Java payload. The issue stems from the default ObjectInputFilter pattern that permits java.net.URL and java.net.InetAddress classes, enabling data exfiltration via an out-of-band DNS side channel.

A vulnerability in Apache Camel allows remote code execution via deserialization of untrusted data in the camel-vertx-http component. An attacker can exploit a man-in-the-middle position or compromised backend to deliver a crafted Java object, leading to code execution on the Camel host.

A vulnerability in the camel-consul component of Apache Camel allows arbitrary code execution via deserialization of malicious Java objects from the Consul KV store. The issue affects ConsulRegistry and ConsulRegistryUtils classes which lack input filtering.

The camel-infinispan component deserializes data from a remote Infinispan cache using java.io.ObjectInputStream without any ObjectInputFilter. An attacker with write access to the cache can inject a crafted serialized Java object, leading to arbitrary code execution during read operations like get or recover.

In Apache Camel, when authentication is enabled on the embedded HTTP server or management server (camel-platform-http-main) with a non-root context path (e.g., /api), authentication is incorrectly restricted to the exact path, excluding its subpaths. Unauthenticated requests to subpaths like /api/_route_ or /admin/observe/info can disclose runtime metadata (user, working directory, PID, JVM and OS information).

The camel-mina component in Apache Camel lacks deserialization filters for IoBuffer, allowing an attacker to achieve remote code execution by sending a crafted Java object to a MINA consumer.

The Camel-PQC FileBasedKeyLifecycleManager class deserializes .key files using java.io.ObjectInputStream without any filters, allowing arbitrary code execution before type checking. An attacker with write access to the key directory can inject a crafted Java object leading to remote code execution.

A deserialization vulnerability in the Apache Camel LevelDB component allows arbitrary code execution. The DefaultLevelDBSerializer class deserializes data without ObjectInputFilter, enabling an attacker with write access to LevelDB files to inject a malicious Java object.

A vulnerability in Apache Camel allows unauthorized exposure of sensitive information. It affects versions from 3.X to 3.14.8, 3.18.X to 3.18.7, 3.20.X to 3.20.5, and 4.X to 4.0.0-M3.