CVE-2026-46453

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.3.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description Improper input validation in the camel-elasticsearch-rest-client component allows for authorization bypass. The component uses unprefixed header constants—SEARCH QUERY, OPERATION, INDEX NAME, INDEX SETTINGS, and ID—which are not blocked by the HttpHeaderFilterStrategy because they lack the required 'Camel' or 'camel' prefix. When a route exposes an HTTP entry point before an elasticsearch-rest-client producer, an untrusted client can provide these headers to override configured queries and operations. This can lead to unauthorized actions such as reading all documents in an index, deleting documents, or exfiltrating specific fields without requiring credentials.

Recommendations Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS stream. Upgrade to version 4.18.3 for those on the 4.18.x stream. As a temporary mitigation, strip the SEARCH QUERY, OPERATION, INDEX NAME, INDEX SETTINGS, and ID headers from untrusted inbound messages before they reach the producer. Apply a custom HeaderFilterStrategy that blocks the aforementioned header names.