Executive brief
Apache Camel is an open-source integration framework used to build message-driven workflows that route data between different systems. The CometD component, which allows real-time bidirectional communication, accepts inbound message headers without filtering, permitting unauthenticated attackers to inject control headers that influence downstream behavior. An attacker could exploit this to redirect HTTP traffic, modify file operations, or alter message destinations, depending on which producers are active in the route.
Technical details
The vulnerability is an improper input validation flaw in the camel-cometd component. The CometdBinding.populateExchangeFromMessage method copies the entire ext.CamelHeaders map from inbound Bayeux messages directly onto the Camel Exchange message without applying a HeaderFilterStrategy. Because the CometdComponent installs no Bayeux SecurityPolicy by default, any client completing the Bayeux handshake can publish such messages without authentication. An attacker can inject Camel-reserved header names (CamelHttpUri, CamelFileName, CamelJmsDestinationName, etc.) that persist across internal hops (direct, seda, vm), influencing downstream producers to perform unintended actions such as SSRF, file manipulation, or message redirection. The fix, available in Camel 4.21.0, 4.18.3, and 4.14.8, implements a HeaderFilterStrategy that strips inbound Camel* and camel* headers case-insensitively.
Affected products
- Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x
- Apache Camel-Cometd 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x
Timeline
- 2026-07-06: disclosed: Publicly disclosed via GitHub Advisory
- 2026-07-06: patched: Patches released: 4.21.0, 4.18.3, 4.14.8