CVE-2026-46584

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description Improper input validation in the Apache Camel Mail Component allows for the exposure of sensitive information. The MailProducer.getSender() function scans outgoing exchanges for message headers within the mail.smtp. and mail.smtps. namespaces. If present, these values are applied as JavaMail session properties, overriding the endpoint configuration. Since this namespace is not blocked by any HeaderFilterStrategy, untrusted input from protocols such as HTTP query parameters, request headers, JMS, or Kafka can be used to manipulate the producer. In versions prior to 4.19.0, an attacker can set the mail.smtp.host variable to redirect the SMTP connection to a malicious server, leading to the theft of configured usernames and passwords. In versions 4.19.0 and later, the impact is limited to weakening transport security via variables such as mail.smtp.ssl.trust, mail.smtp.starttls.enable, or mail.smtp.socks.host, potentially allowing the interception of outgoing messages.

Recommendations Upgrade Apache Camel versions 4.0.0 through 4.14.7 to version 4.14.8. Upgrade Apache Camel versions 4.15.0 through 4.18.2 to version 4.18.3. Upgrade Apache Camel versions 4.19.0 through 4.20.9 to version 4.21.0. As a temporary workaround, use removeHeaders('mail.smtp.*') and removeHeaders('mail.smtps.*') to strip the namespace between any untrusted ingress and the smtp/smtps producer. Restrict the use of per-message overrides by ensuring useJavaMailSessionPropertiesFromHeaders is set to false, enabling it only on trusted endpoints.