CVE-2026-46585

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description Improper input validation in the Apache Camel Lucene Component allows for authorization bypass through user-controlled keys. The camel-lucene producer reads search phrases from an Exchange header LuceneConstants.HEADER QUERY (with the value QUERY) and HEADER RETURN LUCENE DOCS (with the value RETURN LUCENE DOCS). Since these names lack the Camel or camel prefix, the HttpHeaderFilterStrategy allows them to pass from inbound HTTP requests into the Exchange. In routes exposing Lucene query operations via an HTTP consumer, an attacker can set the QUERY header to execute arbitrary queries against the full-text index, overriding intended filters. This can lead to unauthorized access to documents or high CPU consumption through expensive regular-expression queries. No credentials are required if the HTTP consumer is unauthenticated.

Recommendations Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS stream. Upgrade to version 4.18.3 for those on the 4.18.x stream. After upgrading, routes setting the query via raw header names must use CamelLuceneQuery and CamelLuceneReturnLuceneDocs instead of QUERY and RETURN LUCENE DOCS. As a temporary mitigation, strip the QUERY and RETURN LUCENE DOCS headers before the Lucene producer and set the query from a trusted source.