CVE-2026-46454

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description Improper input validation in the Apache Camel Cometd component allows unauthenticated users to inject arbitrary Camel control headers. The CometdBinding.populateExchangeFromMessage() function copies the ext.CamelHeaders map from the CometD client directly into the Camel message without using a HeaderFilterStrategy. Since no Bayeux SecurityPolicy is installed by default, any client completing the Bayeux handshake can publish messages that modify internal control headers such as CamelHttpUri, CamelFileName, or CamelJmsDestinationName. This can lead to the redirection of HTTP producers, modification of file names, or overriding of JMS destinations, with the injected headers persisting across internal direct, seda, and vm hops.

Recommendations Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.3 for those on the 4.18.x releases stream. Strip Camel control headers from inbound CometD messages using removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route. Install an explicit Bayeux SecurityPolicy on the CometdComponent to ensure only authenticated clients can publish messages.