Executive brief
Apache Camel is an integration framework that routes messages between applications. The CXF component in Camel bridges HTTP requests to SOAP web services. A flaw in how Camel's CXF SOAP producer selects which operation to invoke allows an HTTP client to inject custom headers that bypass Camel's security filtering, redirecting the operation invoked on the backend SOAP service. An attacker could, for example, replace a read operation with a destructive write operation against the backend service without authentication or special privileges.</brief> <parameter name="summary">Apache Camel CXF SOAP operation selection headers (operationName, operationNamespace) used non-prefixed names that bypassed HTTP header filtering, allowing remote attackers to redirect invoked SOAP operations without authentication. Affected versions: 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, and 4.19.0 to 4.20.x. Fixed in 4.14.8, 4.18.3, and 4.21.0.
Technical details
The vulnerability is an improper input validation (CWE-20) and confused deputy (CWE-441) issue in Apache Camel's CXF SOAP component. The camel-cxf and camel-cxfrs producers select which SOAP operation to invoke by reading the operationName and operationNamespace Exchange headers. These header names were defined as plain strings ("operationName", "operationNamespace") without the "Camel" or "camel" prefix. HttpHeaderFilterStrategy, Camel's header filtering mechanism, only blocks headers in the Camel namespace, allowing unprefixed headers to pass through from inbound HTTP requests directly into the message Exchange. In routes that bridge an HTTP consumer (e.g., platform-http) to a cxf: producer, any unauthenticated HTTP client can set these headers to redirect the operation invoked on the backend SOAP service—for example, changing a benign read operation to a destructive write. The fix renames the headers to CamelCxfOperationName and CamelCxfOperationNamespace so they are properly filtered at transport boundaries. Patches are available in versions 4.14.8, 4.18.3, and 4.21.0. Workaround: strip operationName and operationNamespace headers from untrusted ingress before the cxf: producer and set the operation from a trusted source.
Affected products
- Apache Camel CXF SOAP 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x
- Apache Camel CXF REST 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x
Timeline
- 2026-07-06: disclosed: Advisory published
- 2026-07-06: patched: Patches released in versions 4.14.8, 4.18.3, and 4.21.0