CVE-2026-78164

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description Apache Camel HTTP, Netty HTTP, Undertow, and Vert.x HTTP components contain an issue where inbound messages can override the endpoint URI using the CamelHttpUri and CamelRestHttpUri headers. These headers are processed through CamelContext.resolvePropertyPlaceholders(), which is a configuration-resolution facility. This allows an attacker to access operating-system environment variables, JVM system properties, registered PropertiesFunction secret functions (including AWS, Azure, GCP, HashiCorp, IBM, CyberArk, and Kubernetes), and invoke no-argument methods on any bean in the registry via camel-bean.

Seven call sites are affected:

Certain HTTP consumers may automatically populate CamelHttpUri from the request line. Additionally, unresolvable placeholders can trigger a RuntimeExchangeException that echoes the URI, potentially revealing whether a configuration key is set.

Recommendations Upgrade to version 4.23.0. For the 4.22.x release stream, upgrade to 4.22.1. For the 4.18.x release stream, upgrade to 4.18.5. For deployments on version 4.14.x and earlier, move to a supported release. As a temporary workaround, strip the override headers at the trust boundary using removeHeader("CamelHttpUri") and removeHeader("CamelRestHttpUri") before the producer. As a temporary workaround for camel-http endpoints, set skipControlHeaders=true. Apply a strict inbound HeaderFilterStrategy over the Camel namespace for consumers exposed to untrusted senders. Resolve secrets through a vault instead of environment variables or system properties.