Executive brief
Apache Camel's Solr integration component fails to properly filter HTTP headers when bridging requests from web consumers to Solr servers. An unauthenticated attacker can inject malicious headers to manipulate Solr query parameters, triggering server-side requests to arbitrary URLs (SSRF attacks targeting internal services or cloud metadata endpoints) or inject unauthorized data fields into indexed documents. This vulnerability affects deployments using HTTP-to-Solr routes without proper authentication.
Technical details
The camel-solr component uses non-Camel-prefixed header constants (SolrParam. and SolrField.) to pass through Exchange headers into Solr requests and indexed documents. The HttpHeaderFilterStrategy in Camel only blocks headers in the "Camel" namespace, allowing SolrParam.* and SolrField.* headers from untrusted HTTP ingress to bypass filtering and reach the Exchange object. An attacker can set arbitrary SolrParam.* headers to inject Solr parameters like "shards" or "stream.url" (causing SSRF), or "qt" (accessing admin handlers), and SolrField.* headers to inject fields into indexed documents. No authentication is required when the HTTP consumer is unauthenticated. The fix changes the prefix constants to use the Camel namespace (CamelSolrParam. / CamelSolrField.), which are properly filtered by HttpHeaderFilterStrategy.
Affected products
- Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x
Timeline
- 2026-07-06: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-07-06: patched: Fixes released in versions 4.14.8, 4.18.3, and 4.21.0