CVE-2026-47323: Apache Camel header injection in CXF and Knative components

CVE-2026-47323 · Severity: critical · CVSS 9.8 · Published 2026-05-19

Apache Camel components used for web services and serverless networking fail to properly filter incoming data. This allows an unauthenticated attacker to send malicious requests that can take control of the server or modify sensitive files. Organizations using these components to route data to system commands or file storage are at high risk of full system compromise.

Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-47323 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47323 being exploited in the wild.
How severe is CVE-2026-47323?
Critical severity, with a CVSS score of 9.8, published 19 May 2026.
Which products and versions are affected?
Apache Software Foundation Camel-CXF 3.18.0 to 4.14.5, 4.15.0 to 4.18.1; Apache Software Foundation Camel-Knative 3.18.0 to 4.14.5, 4.15.0 to 4.18.1; org.apache.camel:camel-cxf-rest (Maven) ECOSYSTEM:introduced=3.18.0,fixed=4.14.6.
Is there a fix for CVE-2026-47323?
Yes. org.apache.camel:camel-cxf-rest (Maven): upgrade to 4.14.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47323 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47323?
Check whether you run Apache Software Foundation Camel-CXF, Apache Software Foundation Camel-Knative or org.apache.camel:camel-cxf-rest (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-cxf-rest (Maven): upgrade to 4.14.6 or later
    # set org.apache.camel:camel-cxf-rest to 4.14.6 in your pom.xml or build.gradle

Technical details

A vulnerability exists in the HeaderFilterStrategy implementations of camel-cxf and camel-knative-http (specifically CxfRsHeaderFilterStrategy, CxfHeaderFilterStrategy, and KnativeHttpHeaderFilterStrategy). These components fail to implement inbound filtering via 'setInFilterStartsWith', allowing unauthenticated attackers to inject internal Camel headers through HTTP requests to CXF-RS or CXF-SOAP endpoints. If these messages are subsequently routed to header-driven components like 'camel-exec' or 'camel-file', the injected headers (e.g., CamelExecCommandExecutable) can override system settings to execute arbitrary commands or write files. Users should upgrade to Apache Camel 4.14.6, 4.18.2, or 4.19.0.

Affected products

  • Apache Camel-CXF 3.18.0 to 4.14.5, 4.15.0 to 4.18.1
  • Apache Camel-Knative 3.18.0 to 4.14.5, 4.15.0 to 4.18.1

Identifiers

  • CVE-2026-47323
  • GHSA-8364-hfqj-pwm6

Timeline

  • 2026-05-19: disclosed
  • 2026-05-19: advisory
  • 2026-06-04: patched: Review and update of advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.