Is CVE-2026-46592 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46592 being exploited in the wild.

How severe is CVE-2026-46592?

High severity, with a CVSS score of 7.5, published 6 July 2026.

Which products and versions are affected?

Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x; org.apache.camel:camel-cxf-rest (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.14.8; org.apache.camel:camel-cxf-soap (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.14.8.

Is there a fix for CVE-2026-46592?

Yes. org.apache.camel:camel-cxf-rest (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-cxf-soap (Maven): upgrade to 4.14.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46592 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46592?

Check whether you run Apache Camel, org.apache.camel:camel-cxf-rest (Maven) or org.apache.camel:camel-cxf-soap (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46592: Apache Camel improper input validation in CXF SOAP component

CVE-2026-46592 · Severity: high · CVSS 7.5 · Published 2026-07-06

Apache Camel is an integration framework that routes messages between applications. The CXF component in Camel bridges HTTP requests to SOAP web services. A flaw in how Camel's CXF SOAP producer selects which operation to invoke allows an HTTP client to inject custom headers that bypass Camel's security filtering, redirecting the operation invoked on the backend SOAP service. An attacker could, for example, replace a read operation with a destructive write operation against the backend service without authentication or special privileges.</brief> <parameter name="summary">Apache Camel CXF SOAP operation selection headers (operationName, operationNamespace) used non-prefixed names that bypassed HTTP header filtering, allowing remote attackers to redirect invoked SOAP operations without authentication. Affected versions: 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, and 4.19.0 to 4.20.x. Fixed in 4.14.8, 4.18.3, and 4.21.0.

Technologies: Apache Camel. Vendors: Apache, Maven.

Quick answers

Is CVE-2026-46592 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46592 being exploited in the wild.
How severe is CVE-2026-46592?: High severity, with a CVSS score of 7.5, published 6 July 2026.
Which products and versions are affected?: Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x; org.apache.camel:camel-cxf-rest (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.14.8; org.apache.camel:camel-cxf-soap (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.14.8.
Is there a fix for CVE-2026-46592?: Yes. org.apache.camel:camel-cxf-rest (Maven): upgrade to 4.14.8 or later; org.apache.camel:camel-cxf-soap (Maven): upgrade to 4.14.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46592 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46592?: Check whether you run Apache Camel, org.apache.camel:camel-cxf-rest (Maven) or org.apache.camel:camel-cxf-soap (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.camel:camel-cxf-rest (Maven): upgrade to 4.14.8 or later

# set org.apache.camel:camel-cxf-rest to 4.14.8 in your pom.xml or build.gradle

org.apache.camel:camel-cxf-soap (Maven): upgrade to 4.14.8 or later

# set org.apache.camel:camel-cxf-soap to 4.14.8 in your pom.xml or build.gradle

Technical details

The vulnerability is an improper input validation (CWE-20) and confused deputy (CWE-441) issue in Apache Camel's CXF SOAP component. The camel-cxf and camel-cxfrs producers select which SOAP operation to invoke by reading the operationName and operationNamespace Exchange headers. These header names were defined as plain strings ("operationName", "operationNamespace") without the "Camel" or "camel" prefix. HttpHeaderFilterStrategy, Camel's header filtering mechanism, only blocks headers in the Camel namespace, allowing unprefixed headers to pass through from inbound HTTP requests directly into the message Exchange. In routes that bridge an HTTP consumer (e.g., platform-http) to a cxf: producer, any unauthenticated HTTP client can set these headers to redirect the operation invoked on the backend SOAP service—for example, changing a benign read operation to a destructive write. The fix renames the headers to CamelCxfOperationName and CamelCxfOperationNamespace so they are properly filtered at transport boundaries. Patches are available in versions 4.14.8, 4.18.3, and 4.21.0. Workaround: strip operationName and operationNamespace headers from untrusted ingress before the cxf: producer and set the operation from a trusted source.

Affected products

Apache Camel CXF SOAP 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x
Apache Camel CXF REST 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x

Identifiers

CVE-2026-46592
GHSA-mrrp-9gjm-749v

Timeline

2026-07-06: disclosed: Advisory published
2026-07-06: patched: Patches released in versions 4.14.8, 4.18.3, and 4.21.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.