CVE-2026-46457

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description Improper input validation in the camel-nats component allows a client to inject arbitrary Camel control headers into the Camel Exchange. This occurs because the NatsConsumer uses a DefaultHeaderFilterStrategy without configured inbound rules, causing it to copy all NATS message headers unmodified. An attacker publishing to a consumed NATS subject can inject headers such as CamelHttpUri, CamelFileName, or CamelSqlQuery to influence downstream producers, potentially redirecting HTTP requests, altering file names, or overriding queries. These injected headers persist across internal direct, seda, and vm hops. The issue is accessible without credentials if the NATS server is configured without authentication.

Recommendations Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS stream. Upgrade to version 4.18.3 for those on the 4.18.x stream. As a temporary mitigation, strip Camel control headers from inbound NATS messages at the start of the route using removeHeaders('Camel*') and removeHeaders('camel*'). Enable authentication on the NATS server to ensure only trusted clients can publish to the consumed subject.