CVE-2026-48204

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description Improper input validation and improper access control in the Camel Mongodb Gridfs component allow unauthenticated HTTP clients to hijack GridFS operations. The camel-mongodb-gridfs producer uses the gridfs.operation Exchange header to determine the operation when no explicit operation parameter is set. Because the control headers gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize, and gridfs.fileid do not use the Camel prefix, they bypass the HttpHeaderFilterStrategy and are passed directly from inbound HTTP requests into the Exchange. An attacker can use this to override intended operations—such as changing a file upload to a remove, listAll, or findOne operation—and provide a gridfs.metadata value to perform NoSQL operator injection, which is a technique used to manipulate database queries by injecting NoSQL syntax. This can lead to arbitrary file deletion or reading of files.

Recommendations Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS stream. Upgrade to version 4.18.3 for those on the 4.18.x stream. After upgrading, replace the use of gridfs.* header names with CamelGridFsOperation, CamelGridFsObjectId, CamelGridFsMetadata, CamelGridFsChunkSize, or CamelGridFsFileId in routes driving GridFS operations. As a temporary mitigation, set an explicit operation on the mongodb-gridfs: endpoint and strip all gridfs.* headers from untrusted ingress before they reach the producer.