CVE-2026-46726

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description Improper input validation in the Vertx Websocket component allows an unauthenticated remote attacker to perform Server-Side Request Forgery (SSRF) and expose sensitive information. The camel-vertx-websocket consumer maps inbound WebSocket query and path parameters into the Camel Exchange header map via the populateExchangeHeaders() function without applying a HeaderFilterStrategy. This allows attackers to set internal control headers, such as CamelHttpUri, by providing them as query parameters. If the consumer feeds a downstream HTTP producer, the injected CamelHttpUri redirects the server-side request to an attacker-controlled destination. Furthermore, the HTTP producer resolves Camel property placeholders within the URI, potentially disclosing environment variables, application properties, or vault secrets to the attacker.

Recommendations Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.3 for those on the 4.18.x releases stream. Strip Camel control headers from inbound messages before they reach downstream producers by using removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route. Require authentication on the WebSocket endpoint. Avoid bridging an untrusted consumer directly into an HTTP producer whose target URI can be driven from message headers.