Executive brief
Apache Camel components used for web services and serverless networking fail to properly filter incoming data. This allows an unauthenticated attacker to send malicious requests that can take control of the server or modify sensitive files. Organizations using these components to route data to system commands or file storage are at high risk of full system compromise.
Technical details
A vulnerability exists in the HeaderFilterStrategy implementations of camel-cxf and camel-knative-http (specifically CxfRsHeaderFilterStrategy, CxfHeaderFilterStrategy, and KnativeHttpHeaderFilterStrategy). These components fail to implement inbound filtering via 'setInFilterStartsWith', allowing unauthenticated attackers to inject internal Camel headers through HTTP requests to CXF-RS or CXF-SOAP endpoints. If these messages are subsequently routed to header-driven components like 'camel-exec' or 'camel-file', the injected headers (e.g., CamelExecCommandExecutable) can override system settings to execute arbitrary commands or write files. Users should upgrade to Apache Camel 4.14.6, 4.18.2, or 4.19.0.
Affected products
- Apache Camel-CXF 3.18.0 to 4.14.5, 4.15.0 to 4.18.1
- Apache Camel-Knative 3.18.0 to 4.14.5, 4.15.0 to 4.18.1
Timeline
- 2026-05-19: disclosed
- 2026-05-19: advisory
- 2026-06-04: patched: Review and update of advisory details