CVE-2026-46592

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description An improper input validation issue exists in the Apache Camel CXF SOAP component, leading to a confused-deputy redirection. The camel-cxf producer determines which SOAP operation to invoke on a backend service using the operationName and operationNamespace Exchange headers. Because these headers lacked the required Camel prefix, the HttpHeaderFilterStrategy failed to block them at the HTTP boundary. Consequently, an unauthenticated HTTP client could manipulate these headers to force the CxfProducer to execute a different WSDL operation than intended, such as replacing a read-only operation with a destructive one. This issue also affects camel-cxfrs due to the shared camel-cxf-common module.

Recommendations Upgrade Apache Camel versions 4.0.0 through 4.14.7 to version 4.14.8. Upgrade Apache Camel versions 4.15.0 through 4.18.2 to version 4.18.3. Upgrade Apache Camel versions 4.19.0 through 4.20.9 to version 4.21.0. As a temporary mitigation, strip the operationName and operationNamespace headers from untrusted ingress before they reach the cxf: producer and define the operation from a trusted source within the route.