Executive brief
Apache Camel is an open-source integration framework widely used to connect applications and services. Its Couchbase component processes incoming data and operations, but fails to properly filter headers from untrusted sources. An attacker can inject crafted headers to override legitimate database operations, potentially accessing or modifying sensitive data stored in Couchbase without authorization.
Technical details
This is an improper input validation vulnerability (CWE-20) in the Couchbase component of Apache Camel. The HeaderFilterStrategy, which is responsible for filtering unwanted headers before processing, fails to block non-Camel-prefixed headers that should be restricted. An attacker with network access to the Camel integration (no authentication required) can send crafted messages with malicious headers that bypass the filter and directly influence Couchbase operations. This allows header injection attacks that can steer the producer to perform unintended operations, potentially leading to data exfiltration or data modification. Patches are available in versions 4.14.8, 4.18.3, and 4.21.0.
Affected products
- Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.0
- Apache Camel-Couchbase 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.0
Timeline
- 2026-07-06: disclosed: Vulnerability disclosed via GitHub Advisory Database
- 2026-07-06: patched: Patches released in versions 4.14.8, 4.18.3, and 4.21.0