CVE-2026-48206

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description Improper input validation in the Apache Camel JIRA component allows for authorization bypass. The camel-jira producers read operation parameters from Exchange message headers using plain values defined in JiraConstants, such as IssueKey, ProjectKey, and IssueTransitionId. Because these headers lack the Camel or camel prefix, the HttpHeaderFilterStrategy fails to block them at the HTTP boundary. In routes bridging an HTTP consumer to a jira: producer, an attacker can supply these headers to override intended values and perform unauthorized JIRA operations using the configured service-account credentials. This includes deleting or transitioning issues, creating issues in different projects, modifying fields, managing watchers, or logging work. The impact is limited to the permissions of the configured service account, and no attacker credentials are required if the bridging consumer is unauthenticated.

Recommendations Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS stream. Upgrade to version 4.18.3 for those on the 4.18.x stream. After upgrading, update routes to use CamelJira* header names (e.g., CamelJiraIssueKey) instead of the old raw header names. As a temporary mitigation, strip camel-jira control headers (such as IssueKey, ProjectKey, and IssueTransitionId) from untrusted ingress before they reach the jira: producer and set parameters from a trusted source.