Executive brief
Apache Camel is an open-source integration framework that connects applications and systems. Its CouchDB component allows applications to read from and write to CouchDB databases. A vulnerability in the CouchDB component fails to filter non-standard headers, allowing an attacker to inject malicious headers over the network that override intended database operations—potentially exposing, modifying, or disrupting stored data without requiring any authentication.
Technical details
This is an improper input validation vulnerability (CWE-20) in the Apache Camel camel-couchdb component affecting versions 4.0.0–4.14.7, 4.15.0–4.18.2, and 4.19.0–4.20.0. The root cause is that the HeaderFilterStrategy does not properly validate or filter Exchange headers that do not start with the "Camel" prefix, allowing untrusted input from network sources to pass through unfiltered. An attacker can send crafted HTTP headers or message attributes to a Camel route using the CouchDB producer, which then interprets these headers as control signals to override CouchDB operations. The attack requires network access to the Camel endpoint but no authentication or user interaction. Exploitation can lead to unauthorized read, write, or delete operations against the CouchDB instance. Patches are available in versions 4.14.8, 4.18.3, and 4.21.0.
Affected products
- Apache Camel 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, 4.19.0 through 4.20.0
Timeline
- 2026-07-06: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-07-06: patched: Patches released: versions 4.14.8, 4.18.3, 4.21.0