CVE-2026-49086

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.12.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.x

Description An improper input validation issue exists in the Apache Camel DAPR component, specifically within the DaprPubSubConsumer. The component copies the Pub/Sub component name and topic from inbound CloudEvents into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. Because the DaprConfigurationOptionsProxy prioritizes these headers over the configured destination during republishing, an attacker capable of publishing messages to a subscribed topic can manipulate these values. This allows the attacker to redirect or exfiltrate messages to an arbitrary Dapr Pub/Sub component and topic, bypassing intended routing and topic-level access controls. Exploitation requires the ability to publish to the topic the route subscribes to.

Recommendations Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.3 for those on the 4.18.x releases stream. As a temporary mitigation, remove the CamelDaprPubSubName and CamelDaprTopic headers from the Exchange between the Dapr consumer and any Dapr producer in the route. Restrict publishing permissions for the subscribed Dapr Pub/Sub topic to trusted producers only.