CVE-2026-46584: Apache Camel Mail information exposure via SMTP header injection

CVE-2026-46584 · Severity: low · CVSS 3.7 · Published 2026-07-06

Apache Camel's Mail component allows attackers to inject malicious SMTP configuration headers that override the intended mail server settings. On older versions (before 4.19.0), attackers can redirect email traffic to their own server and steal credentials; on newer versions, they can downgrade transport security or intercept messages. This attack requires a route that accepts untrusted input (such as HTTP query parameters or message queues) and sends email without filtering dangerous headers.

Technologies: Apache Camel, org.apache.camel:camel-mail (Maven). Vendors: Apache, Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-46584 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46584 being exploited in the wild.
How severe is CVE-2026-46584?
Low severity, with a CVSS score of 3.7, published 6 July 2026.
Which products and versions are affected?
Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x; Apache Software Foundation Camel Mail 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x; org.apache.camel:camel-mail (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.14.8.
Is there a fix for CVE-2026-46584?
Yes. org.apache.camel:camel-mail (Maven): upgrade to 4.14.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46584 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46584?
Check whether you run Apache Camel, Apache Software Foundation Camel Mail or org.apache.camel:camel-mail (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-mail (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-mail to 4.14.8 in your pom.xml or build.gradle

Technical details

The MailProducer.getSender method scans outgoing Exchange message headers for mail.smtp.* and mail.smtps.* namespaced properties and applies them as JavaMail session properties, overriding endpoint configuration. The Camel-internal namespace is not blocked by HeaderFilterStrategy, allowing untrusted sources (HTTP query parameters, JMS/Kafka messages) to inject these headers. Impact varies: pre-4.19.0 releases allow attacker-controlled mail.smtp.host to redirect SMTP connections to attacker infrastructure, transmitting endpoint credentials; 4.19.0+ releases connect to the configured host but permit weakening of transport security (ssl.trust, starttls.enable, socks.host) and message interception. Exploitation requires a route that feeds untrusted input to an smtp/smtps producer without intervening removeHeaders filtering. Patches are available in versions 4.14.8, 4.18.3, and 4.21.0, with the override disabled by default post-patch and configurable only via useJavaMailSessionPropertiesFromHeaders=true.

Affected products

  • Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x

Identifiers

  • CVE-2026-46584
  • GHSA-29vj-9mgp-mwp2

Timeline

  • 2026-07-06: disclosed: Vulnerability published
  • 2026-07-06: patched: Patches available: versions 4.14.8, 4.18.3, 4.21.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.