CVE-2026-83531

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.4.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description An issue exists where the dynamic-router-control endpoint allows the compilation of expressions into a Predicate without an allow-list or opt-in mechanism. When handling subscribe or update requests, the DynamicRouterControlProducer extracts the subscription predicate and the language name from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body, or from the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers. The DynamicRouterControlService then resolves the language from the CamelContext and compiles the expression. If a route forwards messages from an external transport to this control endpoint, an attacker can supply an arbitrary expression that is evaluated with the privileges of the Camel process. This includes the always-present simple language. Exploitation requires the ability to send a message on a transport that forwards to a dynamic-router-control endpoint.

Recommendations Upgrade to version 4.23.0. Upgrade to version 4.22.1 for those on the 4.22.x releases stream. Upgrade to version 4.18.5 for those on the 4.18.x releases stream. For deployments that cannot upgrade immediately, do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint. When control messages must cross untrusted transports, authenticate the sender and ensure the predicate and expression language are set by the route by removing CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers and clearing the predicate and expressionLanguage fields of the DynamicRouterControlMessage before it reaches the endpoint. Restrict access to the transports that feed the control endpoint. On versions 4.23.0 and 4.22.1, configure the allowedSchemes option of the dynamic-router endpoint to limit the endpoints a subscription's destinationUri may name.